Security Operations Manager - Assistant Vice President
Manage day-to-day Security Operations Center (SOC) operations and lead a team of analysts monitoring and responding to cyber threats. Core technologies include SIEM (preferably Splunk), SOAR, AWS, and network security tools like IDS, IPS, and DLP.
- Compensation
- Not disclosed
- Location
- Lisbon, Portugal
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Full time
- Experience
- 1+ years
- Category
- Security
- Posted
Skills
Must have
- 5-8 years of experience in security operations
- 1-3 years leading or managing a SOC or security operations team
- Demonstrated people-management experience
- Hands-on experience with the setup and management of a SIEM, preferably Splunk
- Experience with SOAR
- Strong understanding of the incident-response lifecycle and frameworks such as NIST and MITRE ATT&CK
- Knowledge of Linux, Windows, and macOS operating systems
- Professional fluency in English
- Strong coordination and stakeholder-management skills
- Attentive, organized, and detail-oriented, with solid problem-solving and analytical skills
- Excellent written and verbal communication skills
Nice to have
- Experience with cloud infrastructure, AWS preferred
Full description
About the Role
iCapital is looking to hire a SOC Manager to join its Global Information Security team, based in Lisbon, Portugal. This role manages the day-to-day operations of the Security Operations Center (SOC) and leads the team of analysts who monitor, triage, and respond to security alerts. The SOC Manager provides situational awareness through detecting, containing, and resolving cyber security threats using a comprehensive set of technologies including IDS, IPS, DLP, SIEM, SOAR, AWS, SaaS Security, and firewall technologies.
This is a people-management role focused on keeping the SOC running smoothly – coverage, runbooks, triage, and escalation – while developing the analyst team. The SOC Manager works closely with the Cyber Case Manager to ensure incidents flow into case management and are tracked through to closure, and partners with Threat Detection Engineering, Cloud Security, Incident Response, and other Information Security teams to strengthen the firm’s overall cyber resiliency. Based in Lisbon, the role helps provide security operations coverage across global time zones. This role reports to the Security Operations Leader.
Responsibilities
- Manage the day-to-day operations of the Security Operations Center, ensuring monitoring, alerting, triage, and incident response run effectively across the operating day.
- Lead, mentor, and develop a team of SOC analysts – including scheduling, shift and on-call coverage, performance management, hiring, and onboarding.
- Establish and maintain runbooks, playbooks, incident-handling procedures, and daily, weekly, and monthly security checklists.
- Operate, tune, and manage the SIEM and SOAR platforms; maintain alerts and dashboards that surface key security events and provide security assurance.
- Triage and escalate incidents quickly and effectively, setting priorities for the SOC team and coordinating response with other teams across the firm.
- Partner closely with the Cyber Case Manager to ensure incidents flow into case management and are tracked to closure, and to keep the team aligned to case-driven priorities.
- Work alongside Threat Detection Engineering, Cloud Security, Incident Response, and other Information Security teams to improve the firm’s security posture.
- Measure and report on the state of the firm’s cyber security defenses, including operational metrics and regular reporting to leadership.
- Serve as an escalation point for high-severity incidents, including outside standard business hours as needed.
- Drive the evaluation, selection, and configuration of key security tools to enhance Cyber Security Operations.
Qualifications
- 5-8 years of experience in security operations, including 1-3 years leading or managing a SOC or security operations team.