SOC Director: Cyber Defense & Incident Response

Chaos Industries; Los Angeles (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Health benefits

401k + match

Lunch on site

Relocation assistance

Annual bonus

Job summary

CHAOS Industries in Los Angeles seeks a senior Security Operations and Incident Response leader to build and run a world-class SOC protecting critical defense data. You will define the operating model, hire and mentor staff, and own the detection strategy and tooling roadmap.

You will drive proactive threat hunting, coordinate with legal and compliance for CUI/ITAR data, and serve as incident commander through all phases of response. On-site in LA with strong benefits awaits.

Qualifications

• 8+ years in security operations, incident response or threat hunting.
• 4-5+ years leading a SOC or IR team.
• Experience in regulated defense, aerospace or federal environments handling CUI/export data.
• Record of leading significant incidents end to end with executive communication.
• Hands-on depth with SIEM, EDR and SOAR platforms; can write a detection, read a PCAP and pull a timeline.

Responsibilities

• Define the SOC operating model: coverage hours, on-call rotation, escalation tiers, and staff vs MSP split.
• Hire, train and retain analysts and detection engineers; set career paths and high technical bar.
• Write and maintain playbooks, runbooks and SOPs.
• Own the SOC budget, tooling roadmap and vendor relationships.
• Oversee log source coverage and detection content across enterprise IT, CUI enclave, cloud tenants, labs and networks.
• Lead proactive threat hunts driven by intelligence on defense-industrial actors.
• Serve as incident commander through triage, containment and recovery.
• Ensure DFARS 252.204-7012 obligations: 72-hour DoD reporting, media preservation, malware submission.
• Coordinate with Legal/Export Compliance/HR on incidents touching CUI/ITAR/EAR data.
• Run tabletop exercises and purple-team engagements quarterly.
• Monitor data loss and export-controlled data; support insider threat program.
• Produce evidence for CMMC Level 2 and NIST SP 800-171 families.

Skills

Security operations

Incident response

Threat hunting

Leadership

NIST SP 800-171

DFARS 252.204-7012

MITRE ATT&CK mapping

Python/PowerShell scripting

Education

Bachelor's degree in a technical field

Tools

SIEM

EDR

SOAR

Job description

CHAOS Industries in Los Angeles seeks a senior Security Operations and Incident Response leader to build and run a world-class SOC protecting critical defense data. You will define the operating model, hire and mentor staff, and own the detection strategy and tooling roadmap.

You will drive proactive threat hunting, coordinate with legal and compliance for CUI/ITAR data, and serve as incident commander through all phases of response. On-site in LA with strong benefits awaits.