SOC Manager, Cybersecurity

CHAOS Industries is building and scaling a security operations capability to support defense-focused environments and compliance-heavy data handling. This role will help shape how the SOC runs day to day, lead detection engineering, and act as incident commander while ensuring the evidence trail required for key assessments is produced and maintained.

In this position, you will oversee coverage across enterprise IT and controlled enclaves, coordinate with internal stakeholders when CUI, ITAR, or EAR technical data is involved, and report SOC performance to leadership using meaningful operational metrics.

Key Responsibilities

• Define the SOC operating model including coverage hours, on-call rotation, escalation tiers, and the split between in-house staff and managed service partners.
• Hire, train, and retain analysts and detection engineers, establishing clear career paths and a high technical bar.
• Write and maintain playbooks, runbooks, and standard operating procedures used by the SOC.
• Own the SOC budget, tooling roadmap, and vendor relationships.
• Own log source coverage and detection content across enterprise IT, the CUI enclave, cloud tenants, engineering labs, and production and test networks.
• Run detection engineering as a discipline by mapping coverage to MITRE ATT&CK, tuning to reduce noise, testing detections, and retiring detections that do not work.
• Lead proactive threat hunts based on intelligence on actors targeting the defense industrial base.
• Ingest and act on government and industry threat sharing, including DC3/DCISE and NSA Cybersecurity Collaboration Center reporting.
• Serve as incident commander through triage, containment, eradication, recovery, and lessons learned.
• Meet DFARS 252.204-7012 obligations, including 72-hour reporting to DoD, media preservation, and malware submission.
• Coordinate with Legal, Export Compliance, the Facility Security Officer, and HR when incidents touch CUI, ITAR or EAR technical data, classified programs, or personnel.
• Run tabletop exercises and purple-team engagements at least quarterly, then close gaps exposed through those activities.
• Operate data loss monitoring for CUI and export-controlled technical data across endpoints, email, cloud storage, and code repositories.
• Support the insider threat program with monitoring, investigation, and evidence handling suitable for legal and regulatory review.
• Monitor sanctioned and unsanctioned use of AI and SaaS tools against data that must remain within the compliance boundary.
• Produce evidence required for CMMC Level 2 and NIST SP 800-171 assessments, covering Audit and Accountability, Incident Response, Risk Assessment, and System and Information Integrity families.
• Report SOC performance to leadership with metrics such as time to detect, time to contain, coverage gaps, and trend lines.
• Partner with vulnerability management, IT, and engineering teams to convert findings into fixes with owners and dates.
• Use automation and AI-assisted triage (inside the compliance boundary) to ensure analyst time is focused on work that requires judgment.

Requirements

• 8+ years in security operations, incident response, or threat hunting, including 4-5+ years leading a SOC or IR team.
• Experience in a regulated defense, aerospace, or federal environment handling CUI or export-controlled data.
• Track record of leading major incidents end to end, including executive communication and external reporting.
• Working knowledge of NIST SP 800-171, CMMC Level 2, DFARS 252.204-7012, and NIST SP 800-61 incident handling.
• Hands-on depth with SIEM, EDR, and SOAR platforms, including ability to write detections, read packet captures, and build forensic timelines.
• Experience operating security tooling in a government community cloud or similarly restricted tenant.
• Experience managing an MSSP or MDR provider with measurable service levels.
• Scripting ability in Python, PowerShell, or a comparable language, plus fluency in at least one SIEM query language.
• Clear writing for incident reports read by executives, counsel, assessors, and government customers.
• Bachelor's degree in a technical field, or equivalent experience (experience weighed heavily).

Technologies

• MITRE ATT&CK
• SIEM
• EDR
• SOAR
• Python
• PowerShell

Benefits

• Medical, dental, and vision benefits 100% paid for by the company
• 401k with 50% company match up to 6% of pay
• FSA
• HSA
• Life insurance
• Free daily lunch while working onsite
• Fully-stocked kitchen
• Unlimited PTO
• Casual dress code
• Relocation assistance
• Annual bonuses (coming soon)

Preferred

• Experience building a SOC from early stage at a fast-growing hardware or defense technology company
• Experience supporting a C3PAO assessment or DIBCAC review as the owner of incident response and audit evidence
• Insider threat program experience, including work with counterintelligence or DCSA
• Familiarity with NISPOM (32 CFR Part 117) and the boundary between unclassified security operations and classified system monitoring
• Experience monitoring lab, manufacturing, or embedded environments alongside enterprise IT
• Certifications such as GCIH, GCFA, GCIA, GCDA, GNFA, or CISSP
• Prior military, intelligence community, or DoD cyber operations experience

Eligibility and Clearance

• This role requires access to export-controlled information and a U.S. government security clearance. U.S. citizenship is required.
• Preferred Active Secret clearance, or the ability to obtain and maintain one.
• On-site presence required at Los Angeles or Washington DC. Incident response may require work outside business hours and participation in an on-call rotation.

Location: Los Angeles, CA (onsite)

Salary Range: $180,000 - $240,000 per year

Recruiting notice: CHAOS Industries does not accept unsolicited resumes or outreach. Unsolicited submissions will not be reviewed or compensated.