Senior Operations Manager

Amro Fabricating Corporation•Huntington Beach, CA

2d•$106,000 - $135,000

About The Position

As a Security Operations Engineer, you will help protect the organization's systems, identities, data, and operations through security monitoring, threat detection, investigation, and incident response activities. Working across a multi-site environment, you will partner with internal teams and external security providers to improve visibility, strengthen detection capabilities, support timely response efforts, and continuously enhance the organization's cybersecurity posture. This position requires U.S. person status under U.S. export control laws, including U.S. citizens and nationals, lawful permanent residents, refugees, and asylees.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience.
Four or more years of experience in cybersecurity, security operations, incident response, detection engineering, security engineering, threat hunting, or a related discipline.
Hands-on experience investigating security events and determining scope and impact.
Experience with SIEM or security monitoring platforms such as Microsoft Sentinel or similar technologies.
Experience working with endpoint, identity, cloud, email, or network security telemetry.
Familiarity with Microsoft Defender, Microsoft Entra ID, or related Microsoft security technologies.
Experience developing or tuning alerts, analytics, queries, or detection logic.
Working knowledge of common attacker techniques, including credential abuse, privilege escalation, persistence, and lateral movement.
Strong analytical, communication, and documentation skills.
U.S. person status under U.S. export control laws, including U.S. citizens and nationals, lawful permanent residents, refugees, and asylees.

Nice To Haves

Experience in aerospace, defense, manufacturing, federal contracting, or another regulated environment.
Experience with Microsoft 365 Government Community Cloud High (GCC High) or government cloud environments.
Familiarity with CMMC, NIST SP 800-171, DFARS, CUI, or the NIST Cybersecurity Framework.
Experience with Kusto Query Language (KQL), MITRE ATT&CK, threat hunting, or managed SOC and MSSP environments.
Experience supporting significant cybersecurity incidents or ransomware investigations.
Relevant security certifications.

Responsibilities

Monitor and investigate security activity across SIEM, endpoint, identity, email, cloud, network, and other security telemetry sources.
Develop, test, tune, and document security detections, analytics, alerting logic, and monitoring capabilities.
Conduct threat hunts, identify monitoring gaps, and improve visibility across critical environments.
Investigate identity compromise, malware, phishing, endpoint compromise, unauthorized access, suspicious cloud activity, and other cybersecurity events.
Establish incident scope and impact, including affected assets, identities, users, data, and required containment actions.
Coordinate containment and remediation with technology teams, system owners, application owners, and external service providers.
Preserve technical evidence, document investigation findings, validate remediation activities, and escalate significant cybersecurity exposures when appropriate.
Engage business and technical stakeholders during investigations and provide technical evidence to support operational, legal, contractual, compliance, and security decisions.
Collaborate with external SOC and MSSP partners to improve investigation quality, escalation effectiveness, and response outcomes.
Support security metrics, continuous improvement initiatives, and technical evidence requirements associated with cybersecurity, customer, and internal security obligations.