Manager - Security Engineer, Incident Management and Automation

About the role

The Manager - Security Engineering, Incident Management and Automation is responsible for the implementation, operation and continuous improvement of security controls, monitoring capabilities and automation solutions within the Security Operations Centre. The role strengthens MTN's detection, response and operational resilience while aligning with security standards and operational requirements.

Key responsibilities

• Manage and maintain SOC platforms such as SIEM, SOAR, EDR/XDR, NDR, email and cloud security technologies, and lead the development of monitoring use cases, detection content, correlation rules and alerting aligned to MITRE ATT&CK.
• Provide technical leadership during incident investigations, containment and remediation, and integrate, optimise and govern security tools and log sources.
• Partner with MSS providers and internal stakeholders to improve incident detection and response.
• Support AI-enabled security capabilities and automation, develop SOAR playbooks, APIs and automation workflows, and evaluate emerging technologies such as AI-driven detection and security copilots.
• Support the delivery of Cyber Defence projects, write engineering designs and documentation, and work with MTN entities, technology teams and vendors.
• Drive continuous improvement, report SOC performance metrics, ensure compliance with policies and standards, and contribute to strategic planning.

Required profile

• Bachelor's degree in Computer Science, Information Technology, Engineering, Cybersecurity or a related field, or equivalent practical experience.
• 4-6 years' experience in information security, cybersecurity operations or a related environment, including security monitoring, incident response, security operations or security tool administration.
• Experience implementing and operating security automation solutions in enterprise environments; large enterprise experience; telecommunications experience is an advantage.
• Advantageous: CISSP, CISM, GIAC (GCIA, GCIH, GMON, GPEN), OSCP, CEH, SC-200, AZ-500, CCSP, AWS or Azure security specialty.

Required skills

• SIEM and SOAR platforms (e.g. Microsoft Sentinel, Splunk) and EDR/XDR (e.g. Microsoft Defender)
• Scripting and automation (Python, PowerShell, KQL) and REST API integration
• Cloud security across Azure, AWS and/or GCP
• Familiarity with MITRE ATT&CK, MITRE ATLAS, NIST CSF, OWASP, Zero Trust and CIS
• Networking, operating systems and enterprise infrastructure