Security Operations Engineer

Amro Fabricating Corporation; Huntington Beach (CA); On-site; USD 106,000 - 135,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) with company match

Paid time off

Health Savings Account with companycon

Flexible Spending Accounts

Company‑paid life and AD&D insurance

Short‑ and long‑term disability

Job summary

Karman Space & Defense in Huntington Beach, CA seeks a Security Operations Engineer to monitor, detect, investigate, and respond to cyber incidents across SIEM, endpoints, identities, and cloud services. You will partner with internal teams and external providers to strengthen visibility and containment.

The role requires 4+ years in cybersecurity, experience with Microsoft Defender/Entra ID and Microsoft Sentinel, and the ability to develop detections and drive incident response improvements

Qualifications

• Bachelor's degree in cybersecurity or related field, or equivalent professional experience.
• 4+ years of experience in cybersecurity, security operations, incident response, detection engineering, or related.
• Experience with SIEM or security monitoring platforms such as Microsoft Sentinel or similar technologies.
• Experience working with endpoint, identity, cloud, email, or network security telemetry.
• Familiarity with Microsoft Defender, Microsoft Entra ID, or related Microsoft security technologies.
• Experience developing or tuning alerts, analytics, queries, or detection logic.
• Working knowledge of attacker techniques including credential abuse, privilege escalation, persistence, and lateral movement.

Responsibilities

• Monitors and investigates security activity across SIEM, endpoint, identity, email, cloud, and other telemetry sources.
• Develops, tests, tunes, and documents security detections, analytics, alerting logic, and monitoring capabilities.
• Conducts threat hunting activities, identifies monitoring gaps, and improves visibility across critical environments.
• Investigates identity compromise, malware, phishing, endpoint compromise, unauthorized access, and other cybersecurity events.
• Establishes scope, impact, affected assets, identities, users, data, and containment actions for incidents.
• Coordinates containment and remediation activities with technology teams, system owners, and external providers.
• Preserves technical evidence, documents findings, validates remediation, and escalates exposures as needed.
• Engages stakeholders during investigations and provides technical evidence to support security decisions.
• Collaborates with external SOC and MSSP partners to improve investigation quality and response outcomes.
• Supports security metrics, improvements, and evidence requirements related to cybersecurity obligations.

Skills

SIEM experience

Threat hunting

Endpoint security

Microsoft Defender

Microsoft Entra ID

Alert tuning

Analytical skills

Education

Bachelor's degree in cybersecurity or related field

Tools

Microsoft Sentinel

Kusto Query Language (KQL)

MITRE ATT&CK

Job description

Security Operations Engineer

I/T Full Time Professional Huntington Beach, CA, US

Salary Range: $106,000.00 To $135,000.00 Annually

Karman Space & Defense is a leader in the rapid design, development, and production of critical, next-generation system solutions that align with the U.S. Department of War and its allies’ core mission priorities, and meet the accelerating demand for access to space. Building on nearly 50 years of success, we deliver Payload & Protection Systems, Aero/Hydrodynamic Interstage Systems, and Propulsion & Launch Systems to more than 80 prime contractors supporting over 130 space and defense programs.

As a Security Operations Engineer, you will help protect the organization's systems, identities, data, and operations through security monitoring, threat detection, investigation, and incident response activities. Working across a multi-site environment, you will partner with internal teams and external security providers to improve visibility, strengthen detection capabilities, support timely response efforts, and continuously enhance the organization's cybersecurity posture.

Responsibilities

• Monitors and investigates security activity across security information and event management (SIEM), endpoint, identity, email, cloud, network, and other security telemetry sources.
• Develops, tests, tunes, and documents security detections, analytics, alerting logic, and monitoring capabilities.
• Conducts threat hunting activities, identifies monitoring gaps, and improves visibility across critical environments.
• Investigates identity compromise, malware, phishing, endpoint compromise, unauthorized access, suspicious cloud activity, and other cybersecurity events.
• Establishes the scope, impact, affected assets, identities, users, data, and required containment actions for security incidents.
• Coordinates containment and remediation activities with technology teams, system owners, application owners, and external service providers.
• Preserves technical evidence, documents investigation findings, validates remediation activities, and escalates significant cybersecurity exposures when appropriate.
• Engages business and technical stakeholders during investigations and provides technical evidence to support operational, legal, contractual, compliance, and security decisions.
• Collaborates with external Security Operations Center (SOC) and Managed Security Service Provider (MSSP) partners to improve investigation quality, escalation effectiveness, and response outcomes.
• Supports security metrics, continuous improvement initiatives, and technical evidence requirements associated with cybersecurity, customer, and internal security obligations.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience.
• Four or more years of experience in cybersecurity, security operations, incident response, detection engineering, security engineering, threat hunting, or a related discipline.
• Hands-on experience investigating security events and determining scope and impact.
• Experience with security information and event management (SIEM) or security monitoring platforms such as Microsoft Sentinel or similar technologies.
• Experience working with endpoint, identity, cloud, email, or network security telemetry.
• Familiarity with Microsoft Defender, Microsoft Entra ID, or related Microsoft security technologies.
• Experience developing or tuning alerts, analytics, queries, or detection logic.
• Working knowledge of common attacker techniques, including credential abuse, privilege escalation, persistence, and lateral movement.
• Strong analytical, communication, and documentation skills.

Preferred Qualifications

• Experience in aerospace, defense, manufacturing, federal contracting, or another regulated environment.
• Experience with Microsoft 365 Government Community Cloud High (GCC High) or government cloud environments.
• Familiarity with Cybersecurity Maturity Model Certification (CMMC), National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171), Defense Federal Acquisition Regulation Supplement (DFARS), Controlled Unclassified Information (CUI), or the National Institute of Standards and Technology Cybersecurity Framework.
• Experience with Kusto Query Language (KQL), MITRE ATT\&CK, threat hunting, or managed Security Operations Center (SOC) and Managed Security Service Provider (MSSP) environments.
• Experience supporting significant cybersecurity incidents or ransomware investigations.
• Relevant security certifications.

This position requires U.S. person status under U.S. export control laws, including U.S. citizens and nationals, lawful permanent residents, refugees, and asylees.

• Medical, dental, and vision insurance
• 401(k) with company match
• Paid time off
• Health Savings Account (HSA) with company contribution
• Flexible Spending Accounts (FSA)
• Company‑paid life and AD\&D insurance
• Short‑ and long‑term disability coverage

Karman Space and Defense is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, disability, genetic information, protected veteran status, or any other status protected by applicable law.