Manager, Threat Operations (MDR Operations)

About the role

Sophos is looking for an experienced MDR Operations Manager to lead high-performing MDR teams and deliver consistent, high-quality security operations as part of its global 24x7 service. Based in Australia, the role covers operational delivery during APJ hours, with a focus on people development, operational health, investigation quality, customer outcomes and cross-region collaboration. It uses operational data, technology and automation to remove friction and improve how teams work.

Key responsibilities

• Lead and develop MDR Team Leads and analysts, coach them regularly, support career development and build an inclusive, accountable team culture.
• Build leadership capability and succession by mentoring future technical and people leaders.
• Lead operational delivery during APJ hours, covering staffing, workload balancing, queue health, prioritisation and service-level commitments.
• Maintain a clear view of operational health (demand, capacity, backlog, response times, quality, escalations) and act early on emerging risks.
• Ensure effective follow-the-sun operations with clear ownership, high-quality handovers and timely escalation of risks and issues between regions.
• Drive consistent triage and investigation practices, set high standards for quality, documentation and customer communication, and use quality reviews and case reviews to close gaps.
• Use operational data and metrics to understand trends, inform staffing and prioritisation decisions and drive improvements in efficiency, quality and customer outcomes.
• Act as a senior escalation point for complex investigations, service risks and workload challenges, and support major security incidents and high-severity customer situations.
• Maintain contingency plans and operational readiness through skills coverage, onboarding, training, knowledge management, playbooks and tooling readiness.
• Lead change adoption for new detections, tooling, automation and process changes, and reduce operational friction through standardisation, automation and process redesign.
• Partner with Threat Intelligence, Detection Engineering, Incident Response, Product and Engineering teams, and bring APJ perspectives into global MDR planning and capacity planning.

Required profile

• 7+ years in cybersecurity operations, MDR, SOC operations, incident response or a related discipline, including at least 2 years leading people, teams or operational functions.
• Demonstrated experience leading security operations in a high-volume, customer-facing environment, with responsibility for staffing, workload, queue health, service levels and quality.
• Proven people-leadership experience: coaching, performance management, hiring, onboarding and developing Team Leads and senior analysts.
• Experience in a global or 24x7 security operations environment with effective coordination, escalation and handover across regions.

Required skills

• Strong understanding of the end-to-end triage, investigation, escalation, response and customer communication lifecycle.
• Technical understanding of endpoint, network, cloud, identity and security telemetry, with the ability to assess investigation quality.