SOC Manager, Cybersecurity

Chaos Industries; Los Angeles (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Health benefits

401k + match

Lunch on site

Relocation assistance

Annual bonus

Job summary

CHAOS Industries in Los Angeles seeks a senior Security Operations and Incident Response leader to build and run a world-class SOC protecting critical defense data. You will define the operating model, hire and mentor staff, and own the detection strategy and tooling roadmap.

You will drive proactive threat hunting, coordinate with legal and compliance for CUI/ITAR data, and serve as incident commander through all phases of response. On-site in LA with strong benefits awaits.

Qualifications

• 8+ years in security operations, incident response or threat hunting.
• 4-5+ years leading a SOC or IR team.
• Experience in regulated defense, aerospace or federal environments handling CUI/export data.
• Record of leading significant incidents end to end with executive communication.
• Hands-on depth with SIEM, EDR and SOAR platforms; can write a detection, read a PCAP and pull a timeline.

Responsibilities

• Define the SOC operating model: coverage hours, on-call rotation, escalation tiers, and staff vs MSP split.
• Hire, train and retain analysts and detection engineers; set career paths and high technical bar.
• Write and maintain playbooks, runbooks and SOPs.
• Own the SOC budget, tooling roadmap and vendor relationships.
• Oversee log source coverage and detection content across enterprise IT, CUI enclave, cloud tenants, labs and networks.
• Lead proactive threat hunts driven by intelligence on defense-industrial actors.
• Serve as incident commander through triage, containment and recovery.
• Ensure DFARS 252.204-7012 obligations: 72-hour DoD reporting, media preservation, malware submission.
• Coordinate with Legal/Export Compliance/HR on incidents touching CUI/ITAR/EAR data.
• Run tabletop exercises and purple-team engagements quarterly.
• Monitor data loss and export-controlled data; support insider threat program.
• Produce evidence for CMMC Level 2 and NIST SP 800-171 families.

Skills

Security operations

Incident response

Threat hunting

Leadership

NIST SP 800-171

DFARS 252.204-7012

MITRE ATT&CK mapping

Python/PowerShell scripting

Education

Bachelor's degree in a technical field

Tools

SIEM

EDR

SOAR

Job description

CHAOS Industries is redefining modern defense with a multi-product portfolio that gives the ultimate advantage—domain dominance. The company's products are powered by Coherent Distributed Networks (CDN™), empowering warfighters, commercial air operators, and border protection teams to act faster, adapt rapidly, and stay ahead of evolving threats.

CHAOS Industries was founded in 2022 and has raised a total of $1 billion in funding from leading investors, including 8VC, Accel, and Valor Equity Partners. The company is headquartered in Los Angeles, with offices in Washington, D.C., San Francisco, San Diego, and London. For more information, please visit www.chaosinc.com .

What you'll do:

Build and lead the SOC

Define the operating model: coverage hours, on-call rotation, escalation tiers, and the split between in-house staff and managed service partners.

Hire, train and retain analysts and detection engineers. Set clear career paths and hold a high technical bar.

Write and maintain the playbooks, runbooks and standard operating procedures the team works from.

Own the SOC budget, tooling roadmap and vendor relationships.

Detect

Own log source coverage and detection content across enterprise IT, the CUI enclave, cloud tenants, engineering labs, and production and test networks.

Run detection engineering as a discipline: map coverage to MITRE ATT&CK , tune out noise, test detections, and retire what does not work.

Lead proactive threat hunts driven by intelligence on actors that target the defense industrial base.

Consume and act on government and industry threat sharing, including DC3 / DCISE and NSA Cybersecurity Collaboration Center reporting.

Respond

Serve as incident commander for security incidents, from triage through containment, eradication, recovery and lessons learned.

Meet DFARS 252.204-7012 obligations: 72-hour reporting to DoD , media preservation, and malware submission.

Coordinate with Legal, Export Compliance, the Facility Security Officer and HR when an incident touches CUI , ITAR or EAR technical data, classified programs or personnel.

Run tabletop exercises and purple-team engagements at least [quarterly], and close the gaps they expose.

Operate data loss monitoring for CUI and export-controlled technical data across endpoints, email, cloud storage and code repositories.

Support the insider threat program with monitoring, investigation and evidence handling that holds up to legal and regulatory review.

Monitor sanctioned and unsanctioned use of AI and SaaS tools against data that must stay inside the compliance boundary.

Prove it

Produce the evidence that CMMC Level 2 and NIST SP 800-171 assessments require for the Audit and Accountability, Incident Response, Risk Assessment, and System and Information Integrity families.

Report SOC performance to leadership with metrics that mean something: time to detect, time to contain, coverage gaps and trend lines.

Partner with the vulnerability management, IT and engineering teams to turn findings into fixes with owners and dates.

Use automation and AI-assisted triage, inside the compliance boundary, to keep analyst time on work that needs judgment.

What you bring

8+ years in security operations, incident response or threat hunting, including 4-5+ years leading a SOC or IR team.

Experience in a regulated defense, aerospace or federal environment that handles CUI or export-controlled data.

A record of leading significant incidents end to end, including executive communication and external reporting.

Working knowledge of NIST SP 800-171, CMMC Level 2, DFARS 252.204-7012 and NIST SP 800-61 incident handling.

Hands-on depth with SIEM , EDR and SOAR platforms: you can write a detection, read a packet capture and pull a forensic timeline.

Experience operating security tooling in a government community cloud or similarly restricted tenant.

Experience managing an MSSP or MDR provider against measurable service levels.

Scripting ability in Python, PowerShell or a comparable language, and fluency in at least one SIEM query language.

Clear writing. Your incident reports will be read by executives, counsel, assessors and government customers.

Bachelor's degree in a technical field, or equivalent experience. We weigh experience heavily.

Preferred

Experience building a SOC from an early stage at a fast-growing hardware or defense technology company.

Experience supporting a C3PAO assessment or DIBCAC review as the owner of incident response and audit evidence.

Insider threat program experience, including work with counterintelligence or DCSA .

Familiarity with NISPOM (32 CFR Part 117) and the boundary between unclassified security operations and classified system monitoring.

Experience monitoring lab, manufacturing or embedded environments alongside enterprise IT.

Certifications such as GCIH , GCFA , GCIA , GCDA , GNFA or CISSP .

Prior military, intelligence community or DoD cyber operations experience.

Eligibility and clearance

This role requires access to export-controlled information and a U.S. government security clearance. U.S. citizenship is required.

Preferred Active Secret clearance, or the ability to obtain and maintain one.

On-site presence at Los Angeles or Washington DC . Incident response may require work outside business hours and participation in an on-call rotation.

Why CHAOS?

• Health Benefits: Medical, dental, and vision benefits 100% paid for by the company
• Additional benefits: 401k (+ 50% company match up to 6% of pay), FSA, HSA, life insurance, and more
• Our Perks: Free daily lunch while you're working onsite, fully-stocked kitchen, unlimited PTO, casual dress code
• Compensation Components: Competitive base salaries, generous pre-IPO stock option grants, relocation assistance, and (coming soon!) annual bonuses
• Team Growth: 500+employees and counting across 5 global offices

Salary Range: $180,000 - $240,000

The stated compensation range reflects only the targeted base compensation range and excludes additional earnings such as bonus, equity, and benefits. If your compensation requirements fall outside of the range, we still encourage you to apply. The salary range for this role is an estimate based on a range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations.

EXPORT CONTROLS - This position may require access to information and technology that is subject to U.S. export controls. Your responses to the questions below will be used solely to determine your eligibility under U.S. law to receive information and materials subject to U.S. export controls.

Please note this position does not necessarily require eligibility to obtain and maintain a U.S. security clearance.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in CHAOS Industries’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.