SOC Manager

Role overview

Run the day-to-day operation of a 24/7 security operations center serving a regulated financial services environment. This hands-on leadership role oversees analysts, engineers, and threat hunters across two sites and three shifts, with responsibility for staffing, investigation quality, incident escalation, reporting, and controlled updates to operational procedures.

Responsibilities

- Maintain round-the-clock shift coverage across two offices, accounting for leave, sickness, training, and staffing changes. - Hire, onboard, coach, and retain staff, and support progression across Tier 1 to Tier 3 roles. - Monitor response times, escalation quality, and case records; review investigations to ensure evidence and reasoning support each conclusion. - Prepare daily operational summaries and weekly performance reporting using security case and monitoring data. - Serve as the escalation point for highest-priority incidents and coordinate major responses with senior analysts and client security leadership. - Route playbook, runbook, detection, and escalation changes through the required approval process; enforce secure office and access practices.

Requirements

- At least six years of production SOC operations experience, including leadership of 24/7 shifts against service levels. - Direct people-management experience, including hiring and performance management. - Ability to assess the quality of investigations in a SIEM and case-management environment. - Fluent English at approximately B2+/C1 level for regular communication with US security leadership. - Structured, accountable approach to documentation, audit readiness, change control, and security rules. - Available to work full time onsite in Bogotá or Buenos Aires during US Eastern business hours, with escalation on-call; permanent authorization to work in the country of residence is required.

Nice to have

Experience in financial services security operations, regulatory exams or audits, or teams distributed across sites or countries. ITIL v4, CISSP, CISM, or GCIH certification, Spanish fluency, and experience with Elastic, ServiceNow SecOps, endpoint security, identity tools, or reporting dashboards are also useful.

Benefits and work setup

The role is fully onsite at a secure office in Bogotá or Buenos Aires. The position does not include employment visa sponsorship.