Description
iCapital is looking for a Security Operations Manager to join its Global Information Security team in Lisbon, Portugal.
This role manages the day-to-day operations of the Security Operations Center (SOC) and leads a team of analysts who monitor, triage, and respond to security alerts.
The SOC Manager provides situational awareness by detecting, containing, and resolving cyber security threats using various technologies, including IDS, IPS, DLP, SIEM, SOAR, AWS, SaaS Security, and firewall technologies.
Responsibilities:
- Manage the day-to-day operations of the Security Operations Center, ensuring effective monitoring, alerting, triage, and incident response.
- Lead, mentor, and develop a team of SOC analysts, including scheduling, shift and on-call coverage, performance management, hiring, and onboarding.
- Establish and maintain runbooks, playbooks, incident-handling procedures, and daily, weekly, and monthly security checklists.
- Operate, tune, and manage the SIEM and SOAR platforms, maintaining alerts and dashboards that surface key security events.
- Triage and escalate incidents quickly and effectively, setting priorities for the SOC team and coordinating response with other teams.
- Partner with the Cyber Case Manager to ensure incidents flow into case management and are tracked to closure.
- Collaborate with Threat Detection Engineering, Cloud Security, Incident Response, and other Information Security teams to improve the firm's security posture.
- Measure and report on the state of the firm's cyber security defenses, including operational metrics and regular reporting to leadership.
- Serve as an escalation point for high-severity incidents, including outside standard business hours as needed.
- Drive the evaluation, selection, and configuration of key security tools to enhance Cyber Security Operations.
Qualifications:
- 5-8 years of experience in security operations, including 1-3 years leading or managing a SOC or security operations team.
- Demonstrated people-management experience, including leading, mentoring, scheduling, and developing analysts.
- Hands-on experience with SIEM setup and management, preferably Splunk.
- Experience with SOAR and a strong understanding of the incident-response lifecycle and frameworks such as NIST and MITRE ATT&CK.
- Knowledge of Linux, Windows, and macOS operating systems.
- Experience with cloud infrastructure, AWS preferred.
- Strong coordination and stakeholder-management skills, with the ability to liaise across teams and report to leadership.
- Professional fluency in English.
- Attentive, organized, and detail-oriented, with solid problem-solving and analytical skills.
- Excellent written and verbal communication skills.
Benefits:
- Competitive salary, annual performance bonus, and equity.
- 100% employer-paid health and dental insurance.
- Generous paid time off (PTO).
- Flexible work arrangement: 4 days in the office, 1 day remote work.