Cyber Case Manager - Assistant Vice President

About the Role

iCapital is seeking a Cyber Case Manager to join the Global Information Security team within Cyber Security Operations. As the Security Operations Center (SOC) continues to grow, dedicated ownership of the case lifecycle has become essential to ensuring incidents and investigations are consistently tracked and driven to closure. The Cyber Case Manager serves as the single point of accountability for that lifecycle – from intake through resolution – ensuring every case is owned, prioritized, progressing, and documented.

This individual-contributor will report to the Security Operations leader.

Responsibilities

• Own the end-to-end lifecycle of security cases including intake, ownership assignment, progress tracking, and driving cases to resolution and closure.
• Serve as the single point of accountability for case status across the SOC, maintaining an accurate, prioritized, real-time view of all open incidents and investigations.
• Exercise authority to assign, reprioritize, and escalate cases across SOC Analysts, Threat Detection Engineering, and Incident Response to keep work moving and eliminate stalled cases.
• Enforce case-handling SLAs and quality standards; proactively identify aging, blocked, or at-risk cases and escalate to the Security Operations Leader.
• Coordinate cross-functional workstreams spanning incident response, DFIR, insider-threat cases, vulnerability-remediation tracking, audit and GRC findings, and eDiscovery and legal-hold requests.
• Manage case documentation and evidence integrity – ensuring timelines, actions, decisions, and artifacts are captured consistently and remain audit-ready.
• Integrate case workflows with SIEM/SOAR so alerts, enrichment, and automated actions flow into and out of the case record without manual re-keying.
• Produce case metrics and leadership reporting, including MTTD, MTTR, backlog, aging, closure rates, and SLA adherence for SOC leadership and stakeholders.
• Build and continuously improve case-management processes, intake criteria, and runbooks to increase throughput and reduce manager overhead.
• Facilitate case reviews, shift and regional handoffs, and post-incident lessons-learned, ensuring action items are tracked to completion.
• Leverage the SOC’s SIEM and SOAR platforms, with Jira and Confluence as the system of record.
• Collaborate with Legal, Compliance, Human Resources, SOC Analysts, Security Engineering, Cloud Security, Incident Response, and business stakeholders to support sensitive investigations, maintain confidentiality and chain of custody, and strengthen iCapital’s overall cyber resiliency.
• Participate in incident-driven after-hours coordination as needed to keep high-priority cases moving.

Qualifications

• 3–6 years of experience in cyber security operations, incident response, or security case and program management
• Bachelor’s degree in information security, computer science, or information technology is preferred
• Experience in a regulated industry; financial services or fintech is preferred
• Hands-on experience managing incident or case queues in a SOC or incident response environment
• Working knowledge of SIEM and SOAR platforms and how alerts and cases flow through them
• Proficiency with Jira and Confluence for workflow management, tracking, and documentation
• Strong understanding of the incident response lifecycle and frameworks such as NIST and MITRE ATT&CK
• Demonstrated ability to coordinate across teams and drive work to closure through influence and follow-through, without direct reporting authority over those teams
• Familiar with handling sensitive investigations, evidence handling, and chain-of-custody principles
• Exceptional organization, prioritization, and attention to detail while managing many concurrent cases
• Excellent written and verbal communication skills, with the ability to report status clearly to both technical and executive audiences
• Relevant certifications (i.e. GCIH, GCFE, PMP, ITIL, or Splunk and SOAR) are preferred
• Experience with dedicated case-management or SOAR platforms (i.e. ServiceNow SIR, TheHive, Splunk SOAR and Phantom)
• Exposure to insider-threat, DFIR, eDiscovery, legal-hold, or GRC and audit workflows
• Familiar with cloud environments, AWS is preferred and knowledge of Agile frameworks is preferred