Cyber Case Manager

About the Role

iCapital is seeking a Cyber Case Manager to join the Global Information Security team within Cyber Security Operations. As the Security Operations Center (SOC) continues to grow, dedicated ownership of the case lifecycle has become essential to ensuring incidents and investigations are consistently tracked and driven to closure. The Cyber Case Manager serves as the single point of accountability for that lifecycle – from intake through resolution – ensuring every case is owned, prioritized, progressing, and documented. This individual-contributor will report to the Security Operations leader.  

Responsibilities

• Own the end-to-end lifecycle of security cases including intake, ownership assignment, progress tracking, and driving cases to resolution and closure.
• Serve as the single point of accountability for case status across the SOC, maintaining an accurate, prioritized, real-time view of all open incidents and investigations.
• Exercise authority to assign, reprioritize, and escalate cases across SOC Analysts, Threat Detection Engineering, and Incident Response to keep work moving and eliminate stalled cases.
• Enforce case-handling SLAs and quality standards; proactively identify aging, blocked, or at-risk cases and escalate to the Security Operations Leader.
• Coordinate cross-functional workstreams spanning incident response, DFIR, insider-threat cases, vulnerability-remediation tracking, audit and GRC findings, and eDiscovery and legal-hold requests.
• Manage case documentation and evidence integrity – ensuring timelines, actions, decisions, and artifacts are captured consistently and remain audit-ready.
• Integrate case workflows with SIEM/SOAR so alerts, enrichment, and automated actions flow into and out of the case record without manual re-keying.
• Produce case metrics and leadership reporting, including MTTD, MTTR, backlog, aging, closure rates, and SLA adherence  for SOC leadership and stakeholders.
• Build and continuously improve case-management processes, intake criteria, and runbooks to increase throughput and reduce manager overhead.
• Facilitate case reviews, shift and regional handoffs, and post-incident lessons-learned, ensuring action items are tracked to completion.
• Leverage the SOC’s SIEM and SOAR platforms, with Jira and Confluence as the system of record.
• Collaborate with Legal, Compliance, Human Resources, SOC Analysts, Security Engineering, Cloud Security, Incident Response, and business stakeholders to support sensitive investigations, maintain confidentiality and chain of custody, and strengthen iCapital’s overall cyber resiliency.
• Participate in incident-driven after-hours coordination as needed to keep high-priority cases moving.