Build and lead the SOC

Define the operating model: coverage hours, on-call rotation, escalation tiers, and the split between in-house staff and managed service partners.

Hire, train and retain analysts and detection engineers. Set clear career paths and hold a high technical bar.

Write and maintain the playbooks, runbooks and standard operating procedures the team works from.

Own the SOC budget, tooling roadmap and vendor relationships.

Own log source coverage and detection content across enterprise IT, the CUI enclave, cloud tenants, engineering labs, and production and test networks.

Run detection engineering as a discipline: map coverage to MITRE ATT&CK, tune out noise, test detections, and retire what does not work.

Lead proactive threat hunts driven by intelligence on actors that target the defense industrial base.

Consume and act on government and industry threat sharing, including DC3/DCISE and NSA Cybersecurity Collaboration Center reporting.

Serve as incident commander for security incidents, from triage through containment, eradication, recovery and lessons learned.

Meet DFARS 252.204-7012 obligations: 72-hour reporting to DoD, media preservation, and malware submission.

Coordinate with Legal, Export Compliance, the Facility Security Officer and HR when an incident touches CUI, ITAR or EAR technical data, classified programs or personnel.

SOC Manager, Cybersecurity

Responsibilities

Qualification

Preferred

Benefits

Company

Chaos Industries

More roles at Chaos Industries