Security Operations Engineer

Karman Space & Defense is a leader in the rapid design, development, and production of critical, next-generation system solutions that align with the U.S. Department of War and its allies’ core mission priorities, and meet the accelerating demand for access to space. Building on nearly 50 years of success, we deliver Payload & Protection Systems, Aero/Hydrodynamic Interstage Systems, and Propulsion & Launch Systems to more than 80 prime contractors supporting over 130 space and defense programs.

As a Security Operations Engineer, you will help protect the organization's systems, identities, data, and operations through security monitoring, threat detection, investigation, and incident response activities. Working across a multi-site environment, you will partner with internal teams and external security providers to improve visibility, strengthen detection capabilities, support timely response efforts, and continuously enhance the organization's cybersecurity posture.

Responsibilities

• Monitors and investigates security activity across security information and event management (SIEM), endpoint, identity, email, cloud, network, and other security telemetry sources.
• Develops, tests, tunes, and documents security detections, analytics, alerting logic, and monitoring capabilities.
• Conducts threat hunting activities, identifies monitoring gaps, and improves visibility across critical environments.
• Investigates identity compromise, malware, phishing, endpoint compromise, unauthorized access, suspicious cloud activity, and other cybersecurity events.
• Establishes the scope, impact, affected assets, identities, users, data, and required containment actions for security incidents.
• Coordinates containment and remediation activities with technology teams, system owners, application owners, and external service providers.
• Preserves technical evidence, documents investigation findings, validates remediation activities, and escalates significant cybersecurity exposures when appropriate.
• Engages business and technical stakeholders during investigations and provides technical evidence to support operational, legal, contractual, compliance, and security decisions.
• Collaborates with external Security Operations Center (SOC) and Managed Security Service Provider (MSSP) partners to improve investigation quality, escalation effectiveness, and response outcomes.
• Supports security metrics, continuous improvement initiatives, and technical evidence requirements associated with cybersecurity, customer, and internal security obligations.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience.
• Four or more years of experience in cybersecurity, security operations, incident response, detection engineering, security engineering, threat hunting, or a related discipline.
• Hands-on experience investigating security events and determining scope and impact.
• Experience with security information and event management (SIEM) or security monitoring platforms such as Microsoft Sentinel or similar technologies.
• Experience working with endpoint, identity, cloud, email, or network security telemetry.
• Familiarity with Microsoft Defender, Microsoft Entra ID, or related Microsoft security technologies.
• Experience developing or tuning alerts, analytics, queries, or detection logic.
• Working knowledge of common attacker techniques, including credential abuse, privilege escalation, persistence, and lateral movement.
• Strong analytical, communication, and documentation skills.

Preferred Qualifications

• Experience in aerospace, defense, manufacturing, federal contracting, or another regulated environment.
• Experience with Microsoft 365 Government Community Cloud High (GCC High) or government cloud environments.
• Familiarity with Cybersecurity Maturity Model Certification (CMMC), National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171), Defense Federal Acquisition Regulation Supplement (DFARS), Controlled Unclassified Information (CUI), or the National Institute of Standards and Technology Cybersecurity Framework.
• Experience with Kusto Query Language (KQL), MITRE ATT\&CK, threat hunting, or managed Security Operations Center (SOC) and Managed Security Service Provider (MSSP) environments.
• Experience supporting significant cybersecurity incidents or ransomware investigations.
• Relevant security certifications.

This position requires U.S. person status under U.S. export control laws, including U.S. citizens and nationals, lawful permanent residents, refugees, and asylees.

Benefits

• Medical, dental, and vision insurance
• 401(k) with company match
• Paid time off
• Health Savings Account (HSA) with company contribution
• Flexible Spending Accounts (FSA)
• Company‑paid life and AD\&D insurance
• Short‑ and long‑term disability coverage
• Tuition reimbursement

Karman Space and Defense is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, disability, genetic information, protected veteran status, or any other status protected by applicable law.