Security Operations Manager - Assistant Vice President

iCapital is looking to hire a SOC Manager to join its Global Information Security team, based in Lisbon, Portugal. This role manages the day-to-day operations of the Security Operations Center (SOC) and leads the team of analysts who monitor, triage, and respond to security alerts. The SOC Manager provides situational awareness through detecting, containing, and resolving cyber security threats using a comprehensive set of technologies including IDS, IPS, DLP, SIEM, SOAR, AWS, SaaS Security, and firewall technologies.

This is a people-management role focused on keeping the SOC running smoothly – coverage, runbooks, triage, and escalation – while developing the analyst team. The SOC Manager works closely with the Cyber Case Manager to ensure incidents flow into case management and are tracked through to closure, and partners with Threat Detection Engineering, Cloud Security, Incident Response, and other Information Security teams to strengthen the firm’s overall cyber resiliency. Based in Lisbon, the role helps provide security operations coverage across global time zones. This role reports to the Security Operations Leader.

• →Manage the day-to-day operations of the Security Operations Center, ensuring monitoring, alerting, triage, and incident response run effectively across the operating day.
• →Lead, mentor, and develop a team of SOC analysts – including scheduling, shift and on-call coverage, performance management, hiring, and onboarding.
• →Establish and maintain runbooks, playbooks, incident-handling procedures, and daily, weekly, and monthly security checklists.
• →Operate, tune, and manage the SIEM and SOAR platforms; maintain alerts and dashboards that surface key security events and provide security assurance.
• →Triage and escalate incidents quickly and effectively, setting priorities for the SOC team and coordinating response with other teams across the firm.
• →Partner closely with the Cyber Case Manager to ensure incidents flow into case management and are tracked to closure, and to keep the team aligned to case-driven priorities.
• →Work alongside Threat Detection Engineering, Cloud Security, Incident Response, and other Information Security teams to improve the firm’s security posture.
• →Measure and report on the state of the firm’s cyber security defenses, including operational metrics and regular reporting to leadership.
• →Serve as an escalation point for high-severity incidents, including outside standard business hours as needed.
• →Drive the evaluation, selection, and configuration of key security tools to enhance Cyber Security Operations.

• 5-8 years of experience in security operations, including 1-3 years leading or managing a SOC or security operations team.
• Demonstrated people-management experience – leading, mentoring, scheduling, and developing analysts.
• Hands-on experience with the setup and management of a SIEM, preferably Splunk.
• Experience with SOAR and a strong understanding of the incident-response lifecycle and frameworks such as NIST and MITRE ATT&CK.
• Knowledge of Linux, Windows, and macOS operating systems.
• Experience with cloud infrastructure, AWS preferred.
• Strong coordination and stakeholder-management skills, with the ability to liaise across teams and report to leadership.
• Professional fluency in English to support a global team.
• Attentive, organized, and detail-oriented, with solid problem-solving and analytical skills.
• Excellent written and verbal communication skills..

We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday).