Protect sensitive data

• Operate data loss monitoring for CUI and export-controlled technical data across endpoints, email, cloud storage and code repositories.
• Support the insider threat program with monitoring, investigation and evidence handling that holds up to legal and regulatory review.
• Monitor sanctioned and unsanctioned use of AI and SaaS tools against data that must stay inside the compliance boundary.

Prove it

• Produce the evidence that CMMC Level 2 and NIST SP 800-171 assessments require for the Audit and Accountability, Incident Response, Risk Assessment, and System and Information Integrity families.
• Report SOC performance to leadership with metrics that mean something: time to detect, time to contain, coverage gaps and trend lines.
• Partner with the vulnerability management, IT and engineering teams to turn findings into fixes with owners and dates.
• Use automation and AI-assisted triage, inside the compliance boundary, to keep analyst time on work that needs judgment.

What you bring

• 8+ years in security operations, incident response or threat hunting, including 4-5+ years leading a SOC or IR team.
• Experience in a regulated defense, aerospace or federal environment that handles CUI or export-controlled data.
• A record of leading significant incidents end to end, including executive communication and external reporting.
• Working knowledge of NIST SP 800-171, CMMC Level 2, DFARS 252.204-7012 and NIST SP 800-61 incident handling.
• Hands-on depth with SIEM, EDR and SOAR platforms: you can write a detection, read a packet capture and pull a forensic timeline.
• Experience operating security tooling in a government community cloud or similarly restricted tenant.
• Experience managing an MSSP or MDR provider against measurable service levels.
• Scripting ability in Python, PowerShell or a comparable language, and fluency in at least one SIEM query language.
• Clear writing. Your incident reports will be read by executives, counsel, assessors and government customers.
• Bachelor's degree in a technical field, or equivalent experience. We weigh experience heavily.

Preferred

• Experience building a SOC from an early stage at a fast-growing hardware or defense technology company.
• Experience supporting a C3PAO assessment or DIBCAC review as the owner of incident response and audit evidence.
• Insider threat program experience, including work with counterintelligence or DCSA.
• Familiarity with NISPOM (32 CFR Part 117) and the boundary between unclassified security operations and classified system monitoring.
• Experience monitoring lab, manufacturing or embedded environments alongside enterprise IT.
• Certifications such as GCIH, GCFA, GCIA, GCDA, GNFA or CISSP.
• Prior military, intelligence community or DoD cyber operations experience.

Eligibility and clearance

• This role requires access to export-controlled information and a U.S. government security clearance. U.S. citizenship is required.
• Preferred Active Secret clearance, or the ability to obtain and maintain one.
• On-site presence at Los Angeles or Washington DC. Incident response may require work outside business hours and participation in an on-call rotation.

Why CHAOS?

• Health Benefits: Medical, dental, and vision benefits 100% paid for by the company
• Additional benefits: 401k (+ 50% company match up to 6% of pay), FSA, HSA, life insurance, and more
• Our Perks: Free daily lunch while you're working onsite, fully-stocked kitchen, unlimited PTO, casual dress code
• Compensation Components: Competitive base salaries, generous pre-IPO stock option grants, relocation assistance, and (coming soon!) annual bonuses
• Team Growth: 500+ employees and counting across 5 global offices

Salary Range: $180,000 - $240,000

The stated compensation range reflects only the targeted base compensation range and excludes additional earnings such as bonus, equity, and benefits. If your compensation requirements fall outside of the range, we still encourage you to apply. The salary range for this role is an estimate based on a range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations.

Recruiting Agencies: CHAOS Industries does not accept unsolicited resumes or outreach. Unsolicited submissions will not be reviewed or compensated.

#LI-onsite