Security Monitoring & Incident Response Product Owner (m/f/d)

SOC Operations & Service Management 

• Own the end-to-end operations of the global SOC, ensuring effective collaboration between internal analysts and the MSSP (L1/L2).
• Monitor, manage, and optimize processes, including alert triage, escalation flows, and incident response handovers.
• Ensure all services related to Security Monitoring and Incident Response to perform against defined SLAs and KPIs, and drive actions when service quality deviates.
• Implement the SOC “product” roadmap related to Security Monitoring & Incident Response, including implementation of the strategic vision, backlog, and prioritization of improvements. 

Vendor & MSSP Management 

• Act as the primary liaison between the organization and the MSSP to deliver SOC services.
• Conduct recurring service governance meetings (operational and tactical).
• Track and validate MSSP deliverables, including detection operations, case handling quality, and runbook adherence.
• Coordinate improvements to MSSP workflows, communication channels, and response processes. 

Incident Response Alignment 

• Align with the internal incident response team to ensure seamless escalation.
• Support the refinement of incident response procedures, playbooks, and communication guidelines.
• Ensure major incidents are appropriately handled, documented, and followed by lessons learned sessions.
• Guide the continuous evolution of incident management maturity and readiness.  

Governance, Compliance & Documentation

• Maintain alignment with internal security frameworks, standards, and regulatory requirements.
• Produce regular reports on operational performance, risks, coverage, and incident trends.
• Ensure processes, runbooks, service definitions, and operating procedures are consistently documented and kept up to date.
• Support audits, assessments, and readiness activities related to detection and response.