Cyber Monitoring Use Case Manager

About the role

The Cyber Monitoring Use Case Manager defines, governs and continuously improves cybersecurity detection use cases within the Cyber Defense Operations Center (CDOC). The role also defines and governs log collection requirements across on-premise infrastructure, cloud platforms and SaaS services, working with Platform Engineering and MSSP partners so that telemetry is sufficient, reliable and aligned with detection, threat hunting and incident response needs. It acts as a key interface between Cyber Monitoring Analysts, CSIRT, Threat Intelligence, Platform Engineering and external MSSP partners.

Key responsibilities

• Define and maintain the detection use case roadmap aligned with business risks and threat intelligence, and set up governance frameworks, standards and approval processes.
• Ensure use cases align with MITRE ATT&CK and DeTTECT, and prioritize them by risk, coverage gaps and operational value.
• Oversee the creation, evolution and retirement of use cases, coordinating development across SIEM, SOAR and Threat Intelligence platforms, and validating detections through threat hunting, red team exercises and security validation tools.
• Supervise Cyber Monitoring Analysts and Use Case Engineers, and ensure smooth interaction between Cyber Monitoring, CSIRT and MSSP teams.
• Define and track KPIs for detection effectiveness (coverage, false positives, detection rate, response time) and provide dashboards and reports to stakeholders and leadership.
• Maintain documentation and knowledge bases, and monitor emerging threats to integrate new techniques and indicators into detection logic.
• Identify opportunities for automation, playbook integration and operational efficiency.

Required profile

• Experience in Cyber Monitoring, SOC, Detection Engineering or Incident Response roles.
• Degree in Cybersecurity, Computer Science or a related field, or equivalent professional experience.
• A background in use-case management, service delivery or security product management is a strong advantage.
• Ability to coordinate cross-functional teams, communicate with technical and non-technical stakeholders, and work in a service-oriented, performance-driven environment.

Required skills

• Strong understanding of SOC/CDOC operations and cyber threat detection.
• SIEM platforms (Microsoft Sentinel) and detection engineering concepts (SIGMA rules, Security Copilot).
• Log collection for on-premise, cloud and SaaS sources; knowledge of MITRE ATT&CK and threat intelligence.
• Agile implementation of a use case factory in sprints, using Git, Terraform, SIGMA and KQL.
• Familiarity with SOAR, automation and alert triage workflows.