Security Operations Manager (SecOps Manager)
A leader who organizes the protection of a crypto project's platform, assets and users: attack monitoring, incident response, and control of access and wallets.
What a Security Operations Manager does
The Security Operations Manager is responsible for the day-to-day work of the team that continuously monitors the security of a crypto platform: an exchange, a swap service, a custodial service or a DeFi protocol. The goal is for attacks, hacks, fraud attempts and internal violations to be detected quickly and for the response to be predictable and documented. In the crypto vertical the cost of a mistake is high: stolen funds can often not be recovered, so the role sits at the intersection of infrastructure, financial operations and compliance.
Crypto companies create this role because their threats are specific: phishing of employees and users, compromise of private keys, attacks on hot wallets, withdrawal address substitution, social engineering in support, smart contract exploits and API attacks. Standard SOC processes from traditional IT need to be adapted to blockchain transactions, multisig and cold storage. The Security Operations Manager ties these elements into a single workflow.
The role usually reports to the CISO or head of information security, and in smaller teams to the CTO or COO. The team includes SOC analysts, incident response engineers and sometimes blockchain monitoring specialists. The manager sets shift schedules and priorities, coordinates escalations with infrastructure, risk and legal teams, and reports on the state of security to leadership.
Responsibilities
- Organize 24/7 monitoring of security events, including SIEM, EDR and network sensor alerts, and on-chain analytics on suspicious fund withdrawals.
- Manage the incident lifecycle: classification, escalation, containment, remediation and post-incident review (post-mortem).
- Control procedures for handling keys and hot wallets: multisig, separation of duties, key rotation and withdrawal limits.
- Agree with engineering and DevOps on production access rules, network segmentation and management of privileged accounts.
- Lead the response to phishing and social engineering, including domain blocking, user communication and coordination with support.
- Coordinate security testing: bug bounty programs, external audits, tabletop response exercises and review of detection rules.
- Prepare regular reporting for leadership and, where needed, for regulators or partners: threat landscape, closed incidents, and risks with their owners.
- Keep policies and runbooks up to date, and train shifts and related teams on incident actions.
- Work with law enforcement and external investigation providers within established procedures.
Skills
- Understanding of crypto platform architecture: hot and cold wallets, multisig, nodes, APIs, bridges.
- Knowledge of attack techniques: phishing, account compromise, contract exploits, address substitution, software supply chain attacks.
- Ability to manage an incident under pressure: making decisions with incomplete data and communicating status clearly.
- Building SOC processes: alert prioritization, escalation thresholds, coordination between shifts.
- Basic understanding of blockchain transactions and on-chain analysis for tracing moved funds.
- Working with access policies and the least privilege principle, managing privileges.
- Writing clear policies, reports and post-mortems for both technical and non-technical audiences.
- Managing people and contractors: workload distribution, quality assessment, developing analysts.
Tools
- SIEM systems for log collection and correlation
- EDR and endpoint protection systems
- SOAR platforms for response automation
- Privileged access management (PAM) systems
- On-chain monitoring and transaction analytics tools
- Task and incident trackers (Jira, ServiceNow or similar)
- Key management systems and HSMs
- Vulnerability scanning and patch management tools
How performance is measured
- Mean time to detect (MTTD) and mean time to respond (MTTR) for critical incidents.
- Share of incidents detected before financial loss or before a user report.
- Value of prevented or recovered funds relative to the volume of suspicious transactions.
- Share of alerts closed as false positives and the trend of its reduction after rule tuning.
- Completion of the plan for exercises, audits and closure of critical findings within set deadlines.
- Number of incidents that recur for the same cause after a post-mortem.
By vertical
Crypto
In crypto projects the role focuses on protecting keys, hot wallets and fund withdrawals, as well as tracing transactions on the blockchain. Losses from an attack are often irreversible, so transaction confirmation processes and limits matter more than in traditional IT.
Levels
Management
At the management level, the manager is responsible for the team's strategy and budget, builds processes and metrics, and makes decisions on escalation and communication with leadership. They do not only respond to incidents but also design the system so that incidents happen less often and cost less.
How to get there
Most people move into this role from SOC analyst, incident response engineer, system administrator with security experience, or fraud monitoring specialist in fintech. Practical experience with alerts, investigations and incidents is important, as is an understanding of the infrastructure that needs protecting.
For the crypto vertical, study how blockchains and wallets work separately: how private keys, multisig and cold storage function, and which attack vectors are typical for exchanges and DeFi protocols. It is useful to learn on-chain analytics and how to trace fund movements between addresses and services.
Growth usually comes through a shift from execution to management: first running a shift or a key area, then leading a team and its processes, then taking responsibility for security strategy and working with leadership. Management experience, the ability to write reports for non-technical audiences and to build cross-team collaboration are valued as much as technical expertise.
Next steps: CISO (Chief Information Security Officer), Head of Security or security department lead, Incident Response Manager, Risk & Fraud Operations Manager, Head of Infrastructure Security
FAQ
How is a Security Operations Manager different from a CISO?
The CISO is responsible for the company-wide information security strategy, budget and governance decisions at board level. The Security Operations Manager is responsible for operational work: monitoring, incident response, shift processes and the daily effectiveness of security. This role often prepares candidates for the CISO position.
Do I need to know programming or smart contracts?
Deep programming is usually not required, but understanding code, logs and APIs is necessary for investigations. Basic knowledge of smart contracts helps assess exploit risks and communicate with developers. Smart contract auditing is a separate profession.
What determines income in this role?
Pay depends on the scale of the platform, the volume of assets under management, regulatory requirements for security, team size and the employer's location. The depth of real incident response experience and management tenure also matter. Specific figures depend on the market and negotiation.
Which certifications help in this role?
Employers value proven investigation and response experience more than certificates, but widely recognized industry programs in information security and risk management are usually considered during hiring. A certificate complements practice rather than replacing it.
How can I work in the crypto vertical without crypto experience?
The move is possible from fintech, banking security or telecom SOC. The key is to learn the specifics of wallets, keys and blockchain transactions in a short time and show how your response skills transfer to new threats. In interviews it helps to walk through a real hack or phishing case.
What shift pattern does a SOC team usually work?
SOC work is often organized in shifts or on-call rotations, because threats in the crypto sector do not stop at night or on weekends. The manager is responsible for the schedule, fair distribution of on-call duties and escalation rules outside working hours.
Looking for a job in the industry?
Post an anonymous resume in our bot — recruiters from iGaming, payments and crypto search it every day.