SOC Director: Cybersecurity Operations & Threat Response

Chaos, Inc.; El Segundo, Northern (CA, KY); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Health benefits

401k match

Free daily lunch onsite

Relocation assistance

Unlimited PTO

Casual dress code

Job summary

CHAOS Industries in Los Angeles area seeks a seasoned security leader to build and run the SOC. Define operating model, staffing, budgets, playbooks, and vendor relations to stay ahead of threats.

Lead detection, response, and proactive threat hunts across IT, cloud, and restricted networks, ensuring compliance with NIST SP 800-171, DFARS, and CMMC while delivering executive-ready reports.

Qualifications

• 8+ years in security operations, incident response or threat hunting, incl. 4–5+ years leading a SOC/IR team.
• Experience in regulated defense, aerospace or federal environment with CUI/export data.
• Track record of leading major incidents end-to-end with exec reporting.
• Hands-on depth with SIEM, EDR and SOAR; can write detections and read forensic timelines.
• Experience with government cloud environments and MSSP/MDR management.

Responsibilities

• Build and lead the SOC, define operating model, coverage hours and on-call rotation.
• Hire, train and retain analysts; set career paths and maintain a high technical bar.
• Write and maintain playbooks, runbooks and SOPs the team uses.
• Own the SOC budget, tooling roadmap and vendor relationships.
• Detect across enterprise IT, cloud, and restricted networks and map to MITRE ATT&CK.
• Lead threat hunts and respond as incident commander through containment and recovery.
• Report SOC performance with meaningful metrics to leadership.

Skills

Security operations

Incident response

Threat hunting

SOC leadership

Scripting (Python)

SIEM/EDR/SOAR

Executive communication

MITRE ATT&CK mapping

NIST SP 800-171

Education

Bachelor's degree in a technical field

Tools

SIEM

EDR

SOAR

Job description

CHAOS Industries in Los Angeles area seeks a seasoned security leader to build and run the SOC. Define operating model, staffing, budgets, playbooks, and vendor relations to stay ahead of threats.

Lead detection, response, and proactive threat hunts across IT, cloud, and restricted networks, ensuring compliance with NIST SP 800-171, DFARS, and CMMC while delivering executive-ready reports.