SOC Manager

Why Join AspenView?

At AspenView, we’re more than a nearshore IT partner—we’re a people-first, purpose-driven company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.

Here’s what you can expect:

• Competitive base
• Flexible work model: hybrid, remote, or in-office
• Real growth opportunities and leadership visibility
• Inclusive, respectful culture that blends U.S. innovation with Colombian heart
• A company that listens, invests in you, and celebrates wins together

The SOC Manager is a hands-on operations leader responsible for running the day-to-day operation of a 24/7 security operations centre for a large US consumer lender. Working from AspenView's secure delivery suites in Bogotá or Buenos Aires, you will lead roughly eighteen analysts and engineers across two cities, three tiers and three shifts. The client is regulated under NYDFS Part 500, GLBA, SOX and PCI DSS, so this role goes beyond keeping the lights on. You will make sure every investigation record stands up to examination, on the night shift as well as in the monthly report. You will report to a US-based SOC / Cyber Operations Lead and act as the operational link between the floor, partner governance and the client's security operations team.

What you will do:

Coverage & Team Operations

• Own rosters, coverage and handovers across three 8-hour shifts and two sites, including leave, sickness and training cover, so no shift runs short.
• Lead hiring, onboarding and coaching, and build the Tier 1 to Tier 3 career path that keeps the team together.
• Enforce the secure suite rules, including clean-desk policy and VDI-only access to the client environment.

Performance, Quality & Reporting

• Track operational performance live, including response times, escalation quality and case documentation, instead of discovering problems at month end.
• Ensure every ServiceNow case carries the hypothesis tested, the evidence, the reasoning and the disposition, so an auditor can follow it without asking.
• Build daily, weekly and monthly operational reports from the client's own ServiceNow and Elastic data.

Escalation & Change Control

• Own the escalation path from Tier 2 shift leads to partner governance and the client's security operations team, always escalating with evidence and a recommendation.
• Coordinate with the Incident Response Lead during major incidents.
• Run operational change control for detection rules, playbooks and escalation thresholds, which change only with client approval.

Tools & Technologies:

• SIEM & Case Management: Elastic, Abstract Security and ServiceNow SecOps.
• Endpoint & Identity: CrowdStrike Falcon, Microsoft Defender and Okta.
• Reporting: ServiceNow reporting and Power BI or an equivalent dashboard tool.
• Automation (Bonus): Automation or GenAI tools that reduce analyst toil without hiding work from the audit trail.

What you bring:

• Experience: Proven experience running or deputy-running a SOC, or a 24/7 NOC with security scope, against contractual service levels. You have kept a roster whole through attrition, holidays and sudden resignations, and you can spot a slipping metric before it becomes a missed one.
• Technical Judgment: The ability to read an investigation in ServiceNow, Elastic or an equivalent SIEM and tell whether the analyst actually proved their conclusion.
• Communication / Leadership: Direct people management experience, including hiring, hard conversations and performance plans, not only mentoring. English at B2 or above, strong enough to explain a missed target and its root cause to a US VP of security operations without an intermediary.
• Mindset: Accountable, structured and audit-minded. You treat documentation and change control as part of the job, and you follow and enforce security rules consistently.
• Availability: On-site work in Bogotá or Buenos Aires during US Eastern business hours, plus your share of the management on-call rotation. Access requires identity, criminal background, employment and education checks, repeated periodically.
• Bonus Qualifications: Security operations experience in banking, lending, insurance or payments; exam or audit support under NYDFS Part 500, FFIEC, GLBA, SOX, PCI DSS or SOC 2; leading a team across two sites or countries; ITIL v4, CISSP, CISM or GCIH certification; and Spanish, since the floor is bilingual.