SOC Manager, Cybersecurity

CHAOS Industries is redefining modern defense with a multi-product portfolio that gives the ultimate advantage—domain dominance. The company's products are powered by Coherent Distributed Networks (CDN™), empowering warfighters, commercial air operators, and border protection teams to act faster, adapt rapidly, and stay ahead of evolving threats.
CHAOS Industries was founded in 2022 and has raised a total of $1 billion in funding from leading investors, including 8VC, Accel, and Valor Equity Partners. The company is headquartered in Los Angeles, with offices in Washington, D.C., San Francisco, San Diego, and London. For more information, please visit www.chaosinc.com.
What you'll do:
Build and lead the SOC
Define the operating model: coverage hours, on-call rotation, escalation tiers, and the split between in-house staff and managed service partners.
Hire, train and retain analysts and detection engineers. Set clear career paths and hold a high technical bar.
Write and maintain the playbooks, runbooks and standard operating procedures the team works from.
Own the SOC budget, tooling roadmap and vendor relationships.
Detect
Own log source coverage and detection content across enterprise IT, the CUI enclave, cloud tenants, engineering labs, and production and test networks.
Run detection engineering as a discipline: map coverage to MITRE ATT&CK, tune out noise, test detections, and retire what does not work.
Lead proactive threat hunts driven by intelligence on actors that target the defense industrial base.
Consume and act on government and industry threat sharing, including DC3/DCISE and NSA Cybersecurity Collaboration Center reporting.
Respond
Serve as incident commander for security incidents, from triage through containment, eradication, recovery and lessons learned.
Meet DFARS 252.204-7012 obligations: 72-hour reporting to DoD, media preservation, and malware submission.
Coordinate with Legal, Export Compliance, the Facility Security Officer and HR when an incident touches CUI, ITAR or EAR technical data, classified programs or personnel.
Run tabletop exercises and purple-team engagements at least [quarterly], and close the gaps they expose.
Protect sensitive data
Operate data loss monitoring for CUI and export-controlled technical data across endpoints, email, cloud storage and code repositories.
Support the insider threat program with monitoring, investigation and evidence handling that holds up to legal and regulatory review.
Monitor sanctioned and unsanctioned use of AI and SaaS tools against data that must stay inside the compliance boundary.
Prove it
Produce the evidence that CMMC Level 2 and NIST SP 800-171 assessments require for the Audit and Accountability, Incident Response, Risk Assessment, and System and Information Integrity families.
Report SOC performance to leadership with metrics that mean something: time to detect, time to contain, coverage gaps and trend lines.
Partner with the vulnerability management, IT and engineering teams to turn findings into fixes with owners and dates.
Use automation and AI-assisted triage, inside the compliance boundary, to keep analyst time on work that needs judgment.
What you bring
8+ years in security operations, incident response or threat hunting, including 4-5+ years leading a SOC or IR team.
Experience in a regulated defense, aerospace or federal environment that handles CUI or export-controlled data.
A record of leading significant incidents end to end, including executive communication and external reporting.
Working knowledge of NIST SP 800-171, CMMC Level 2, DFARS 252.204-7012 and NIST SP 800-61 incid