Find your next role

A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You’ll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. With support from our strategic partners, robust IBM technology, and Red Hat, you’ll have the tools to drive meaningful change and accelerate client impact. At IBM Consulting, curiosity fuels success. You’ll be encouraged to challenge the norm, explore new ideas, and create innovative solutions that deliver real results. Our culture of growth and empathy focuses on your long-term career development while valuing your unique skills and experiences.

In this role, you'll work in one of our IBM Consulting FutureNow Centers, where we deliver deep technical and industry expertise to a wide range of public and private sector clients around the world. Our delivery centers offer our clients locally based skills and technical expertise to drive innovation and adoption of new technology.

The Security Service Delivery Manager is responsible for the end-to-end delivery, governance, performance and continuous improvement of cybersecurity managed services for enterprise and BFSI customers.

The role acts as the primary operational interface between the customer and security delivery teams, ensuring that contracted services are delivered within agreed SLA, KPI, quality, security and compliance requirements.

The role will oversee services including SOC, SIEM, SOAR, XDR/EDR, Incident Response, Threat Intelligence, Threat Hunting, Vulnerability Management and Security Engineering.

Key Responsibilities

1. Security Service Delivery

• Own end-to-end delivery of cybersecurity managed services for assigned customers.

• Ensure all services are delivered within agreed SLA, KPI, OLA and contractual commitments.

• Establish service governance, operating processes and escalation mechanisms.

• Monitor service availability, service quality and operational performance.

• Identify service gaps and drive corrective and preventive actions.

• Ensure effective coordination between SOC, engineering, incident response and customer teams.

• Manage service transition and onboarding of new customers.

2. Customer Relationship Management

• Act as the primary operational point of contact for customers.

• Build strong relationships with CISO, CIO, IT, SOC and security stakeholders.

• Conduct regular customer governance meetings.

• Present service performance, security trends, risks, incidents and improvement initiatives.

• Manage customer escalations and ensure timely resolution.

• Understand customer security requirements and translate them into operational service requirements.

• Drive customer satisfaction and retention.

3. Service Governance

• Establish and maintain a structured Service Management Framework.

• Conduct:

o Daily operational reviews

o Weekly service reviews

o Monthly Service Review Meetings

o Quarterly Business Reviews

• Track SLA/KPI performance and service improvement actions.

• Maintain RAID logs covering risks, assumptions, issues and dependencies.

• Manage action items and ensure timely closure.

• Ensure governance documentation is current and audit-ready.

4. Incident & Problem Management

• Own service-level management of security incidents.

• Ensure critical incidents are escalated according to defined procedures.

• Coordinate customer communication during P1/P2 incidents.

• Conduct and present Major Incident Reviews / PIRs.

• Track root-cause analysis and corrective actions.

• Drive Problem Management for recurring security and service issues.

• Identify trends and prevent repeat incidents.

5. SLA & KPI Management

Own the service performance dashboard covering:

Category Metrics

SOC Alert & incident volumes

Detection MTTD

Response MTTA / MTTR

Incident SLA compliance

Quality False Positive Rate

SIEM Log-source availability

SIEM Engineering Use cases delivered

SOAR Automation rate

XDR Endpoint coverage

Service Desk Ticket SLA

Availability Platform/service uptime

Customer CSAT

Improvement CSI initiatives

• Identify SLA breaches and drive recovery plans.

• Establish early-warning mechanisms for SLA risks.

• Maintain monthly KPI trends and management reporting.

6. Resource & Capacity Management

• Work with delivery leadership to ensure appropriate staffing.

• Monitor resource utilization and workload.

• Forecast resource requirements based on:

o Customer growth

o Incident volumes

o Log volumes/EPS

o Number of security technologies

o Service scope

• Support hiring, onboarding and resource ramp-up.

• Ensure appropriate L1/L2/L3 and engineering coverage.

7. Service Transition & Customer Onboarding

• Lead security-service transition from sales/project teams into BAU operations.

• Define transition plans, milestones and acceptance criteria.

• Ensure documentation, architecture, access, SOPs and runbooks are completed.

• Coordinate onboarding of SIEM/XDR/EDR/security data sources.

• Conduct operational readiness reviews.

• Ensure formal handover to BAU teams.

8. Continual Service Improvement

• Identify opportunities to improve service quality, efficiency and customer experience.

• Drive automation and operational optimization.

• Reduce:

o False positives

o MTTR

o Manual activities

o Recurring incidents

o SLA breaches

• Drive adoption of new security technologies and processes.

• Maintain a formal Continuous Service Improvement (CSI) backlog.

9. Compliance & Risk Management

• Ensure services comply with applicable regulatory and contractual requirements.

• Support requirements related to:

o RBI

o CERT-In

o ISO 27001

o NIST

o DPDP Act

o Customer-specific security policies

• Coordinate internal and external audits.

• Track compliance gaps and remediation.

• Maintain evidence required for audits and customer assessments.

19. Vendor & Third-Party Management

• Coordinate with security technology vendors and third-party service providers.

• Manage vendor escalations.

• Track product/platform support issues.

• Coordinate vendor POCs, upgrades and technology changes.

• Monitor vendor SLA and service performance.

Key Deliverables

• Monthly Service Review Report

• Quarterly Business Review

• SOC Performance Dashboard

• SLA/KPI Dashboard

• Security Incident Report

• Major Incident / PIR Report

• Service Improvement Plan

• Capacity & Resource Forecast

• Risk & Issue Register

• Customer Action Tracker

• Service Transition Plan

• Continual Service Improvement Roadmap

10–15+ years of experience in IT/Security Service Delivery.

• 5+ years in cybersecurity managed services/MSSP/SOC environments.

• Strong experience managing enterprise security customers.

• Strong understanding of ITIL/service-management processes.

• Experience managing SLAs, KPIs, OLAs and contractual commitments.

• Experience in BFSI/financial-services environments is preferred.

• Experience managing multiple customers and geographically distributed teams.

Technical Knowledge

Moderate working knowledge of:

• SIEM – IBM QRadar, Microsoft Sentinel, Splunk, Google Chronicle

• SOAR – Cortex XSOAR, QRadar SOAR

• XDR/EDR – Cortex XSIAM, CrowdStrike, Microsoft Defender

• Threat Intelligence / TIP

• Incident Response

• Threat Hunting

• Vulnerability Management

• Cloud Security

• Security Analytics

• MITRE ATT&CK

• NIST

• ISO 27001

Leadership & Behavioural Competencies

• Strong customer relationship management

• Excellent communication and presentation skills

• Executive stakeholder management

• Strong negotiation and escalation-management skills

• Commercial awareness

• Analytical and problem-solving capability

• Strong ownership and accountability

• Crisis and major-incident management

• Ability to manage multiple customers simultaneously

• Strong team leadership and collaboration

• Continuous-improvement mindset

Preferred Certifications

• ITIL 4 Foundation/Managing Professional

• CISSP

• CISM

• ISO 27001 Lead Auditor/Implementer

• PMP/Prince2

• Vendor-specific security certifications