SOC Manager, Cybersecurity

Description

The company builds defense technology. Its products rely on its own distributed networks platform (CDN) and serve warfighters, commercial air operators, and border protection teams who need to respond quickly as threats change.

Founded in 2022, the company has raised $1 billion from investors including 8VC, Accel, and Valor Equity Partners. Headquarters are in Los Angeles, with offices in Washington, D.C., San Francisco, San Diego, and London. The company now has over 500 employees across 5 global offices.

Responsibilities

• Stand up the security operations center from the ground up and lead it.
• Decide how the SOC runs: hours of coverage, on-call rotation, escalation tiers, and how work divides between your in-house staff and outside managed service partners.
• Recruit, develop, and keep analysts and detection engineers. Create clear career paths and maintain a high technical standard.
• Write and keep current the playbooks, runbooks, and standard procedures the team follows.
• Manage the SOC budget, the tooling roadmap, and relationships with vendors.
• Own log source coverage and detection content for enterprise IT, the CUI enclave, cloud tenants, engineering labs, and production and test networks.
• Run detection engineering in a disciplined way: map coverage to MITRE ATT&CK, reduce noise, test detections, and remove those that fail.
• Lead proactive threat hunts based on intelligence about actors targeting the defense industrial base.
• Review and act on threat sharing from government and industry, including DC3 / DCISE and NSA Cybersecurity Collaboration Center reports.
• Act as incident commander for security incidents, from triage through containment, eradication, recovery, and lessons learned.
• Meet DFARS 252.204-7012 requirements: report to DoD within 72 hours, preserve media, and submit malware.
• Work with Legal, Export Compliance, the Facility Security Officer, and HR when an incident involves CUI, ITAR or EAR technical data, classified programs, or personnel.
• Run tabletop exercises and purple-team engagements at least [quarterly], and close the gaps they reveal.
• Operate data loss monitoring for CUI and export-controlled technical data on endpoints, email, cloud storage, and code repositories.
• Support the insider threat program through monitoring, investigations, and evidence handling that can withstand legal and regulatory scrutiny.
• Monitor approved and unapproved use of AI and SaaS tools against data that must remain inside the compliance boundary.
• Produce the evidence that CMMC Level 2 and NIST SP 800-171 assessments require for the Audit and Accountability, Incident Response, Risk Assessment, and System and Information Integrity families.
• Report SOC performance to leadership using meaningful measures: time to detect, time to contain, coverage gaps, and trends.
• Work with vulnerability management, IT, and engineering teams to turn findings into fixes that have named owners and due dates.
• Apply automation and AI-assisted triage within the compliance boundary so analysts spend their time on work that needs judgment.

Requirements

• 8+ years in security operations, incident response, or threat hunting, including 4-5+ years leading a SOC or incident response team.
• Experience in a regulated defense, aerospace, or federal setting that handles CUI or export-controlled data.
• A track record of leading major incidents from start to finish, including briefing executives and making external reports.
• Working knowledge of NIST SP 800-171, CMMC Level 2, DFARS 252.204-7012, and NIST SP 800-61 incident handling.
• Hands-on skill with SIEM, EDR, and SOAR platforms: you can write a detection, read a packet capture, and build a forensic timeline.
• Experience running security tools in a government community cloud or a similarly restricted tenant.
• Experience managing an MSSP or MDR provider against measurable service levels.
• Scripting in Python, PowerShell, or a comparable language, and fluency in at least one SIEM query language.
• Clear writing. Your incident reports will be read by executives, counsel, assessors, and government customers.
• A bachelor's degree in a technical field or equivalent experience. Experience counts heavily.
• Preferred: experience building a SOC from an early stage at a fast-growing hardware or defense technology company.
• Preferred: experience supporting a C3PAO assessment or DIBCAC review as the owner of incident response and audit evidence.
• Preferred: insider threat program experience, including work with counterintelligence or DCSA.
• Preferred: familiarity with NISPOM (32 CFR Part 117) and the line between unclassified security operations and classified system monitoring.
• Preferred: experience monitoring lab, manufacturing, or embedded environments alongside enterprise IT.
• Preferred: certifications such as GCIH, GCFA, GCIA, GCDA, GNFA, or CISSP.
• Preferred: prior military, intelligence community, or DoD cyber operations experience.

Conditions

The role requires access to export-controlled information and a U.S. government security clearance. U.S. citizenship is required.

Preferred: an active Secret clearance, or the ability to obtain and maintain one.

You must be on site in Los Angeles or Washington, D.C.

Incident response may require work outside business hours and participation in an on-call rotation.

The stated pay range covers base salary only. It excludes bonus, equity, and benefits. Candidates whose expectations fall outside the range are still encouraged to apply. The range is an estimate, and the actual offer may vary based on factors such as experience, education or training, critical skills, and business needs.

Benefits

• Medical, dental, and vision coverage, 100% paid by the company.
• 401k with a 50% company match on up to 6% of pay, plus FSA, HSA, life insurance, and more.
• Free lunch every day when you work on site, a fully stocked kitchen, unlimited PTO, and a casual dress code.
• Competitive base salaries, generous stock option grants before the company goes public, relocation assistance, and annual bonuses (coming soon).