SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 180,000 - 240,000 / annual
CHAOS Industries is a defense technology company founded in 2022 and backed by $1B in funding from top-tier investors including 8VC, Accel, and Valor Equity Partners. The company develops multi-product solutions powered by Coherent Distributed Networks (CDN™) for warfighters, commercial air operators, and border protection teams.
You will build and lead the Security Operations Center (SOC) from the ground up, defining the operating model including coverage hours, on-call rotations, escalation tiers, and the balance between in-house staff and managed service partners. You will hire, train, and retain security analysts and detection engineers while setting clear career paths and maintaining high technical standards. You will own SOC budget, tooling roadmap, and vendor relationships.
Key responsibilities include:
**Detection & Threat Hunting**: Own log source coverage and detection content across enterprise IT, CUI enclaves, cloud tenants, engineering labs, and production/test networks. Run detection engineering as a discipline, mapping coverage to MITRE ATT&CK, tuning out noise, testing detections, and retiring ineffective ones. Lead proactive threat hunts targeting actors who threaten the defense industrial base. Consume and act on government and industry threat sharing including DC3/DCISE and NSA Cybersecurity Collaboration Center reporting.
**Incident Response**: Serve as incident commander for security incidents from triage through containment, eradication, recovery, and lessons learned. Meet DFARS 252.204-7012 obligations including 72-hour DoD reporting, media preservation, and malware submission. Coordinate with Legal, Export Compliance, Facility Security Officer, and HR when incidents involve CUI, ITAR, EAR technical data, classified programs, or personnel. Run tabletop exercises and purple-team engagements at least quarterly and close exposed gaps.
**Data Protection & Compliance**: Operate data loss monitoring for CUI and export-controlled technical data across endpoints, email, cloud storage, and code repositories. Support the insider threat program with monitoring, investigation, and evidence handling that withstands legal and regulatory review. Monitor sanctioned and unsanctioned use of AI and SaaS tools against data that must remain within compliance boundaries.
**Compliance & Reporting**: Produce evidence for CMMC Level 2 and NIST SP 800-171 assessments across Audit and Accountability, Incident Response, Risk Assessment, and System and Information Integrity families. Report SOC performance to leadership with meaningful metrics: time to detect, time to contain, coverage gaps, and trend lines. Partner with vulnerability management, IT, and engineering teams to turn findings into fixes with owners and dates. Use automation and AI-assisted triage within compliance boundaries to keep analyst time focused on judgment-intensive work.
**Requirements**:
- 8+ years in security operations, incident response, or threat hunting, including 4–5+ years leading a SOC or IR team
- Experience in a regulated defense, aerospace, or federal environment handling CUI or export-controlled data
- Familiarity with CMMC, NIST SP 800-171, DFARS, and incident reporting requirements
- Certifications such as GNFA or CISSP preferred
- Prior military, intelligence community, or DoD cyber operations experience preferred
- U.S. citizenship required; Active Secret clearance preferred or ability to obtain and maintain one
- On-site presence at Los Angeles or Washington DC required; incident response may require work outside business hours and on-call rotation participation
