Security Operations Manager

Skylo is building satellite-to-device (NTN) connectivity infrastructure connecting mobile network operators worldwide. Security Operations is the most critically understaffed pillar in our InfoSec build-out relative to its 24/7 mandate, and we're hiring a SecOps Manager to stand up and lead this function from the ground up — covering detection, monitoring, incident response, and threat management across our satellite network, ground infrastructure, and enterprise systems. You'll build the SOC function from scratch rather than inherit one — shaping tooling, process, and team structure for a company defining a new category of critical connectivity infrastructure.

Build and lead Skylo's Cyber Fusion Center function, including staffing model, shift/coverage strategy, and escalation processes for 24/7 monitoring

Own the SIEM/EDR/XDR stack — deployment, tuning, use-case development, and detection engineering

Lead incident response: triage, containment, root cause, and post-incident reporting for security events across cloud, corporate IT, data center and product environments

Define and mature SOC processes — runbooks, playbooks, escalation paths, and metrics (MTTD, MTTR, alert fidelity)

Manage and mentor SOC analysts as the team scales through phased hiring

Partner with Network Operation, Product Security, Cloud Security, and GRC to ensure shared visibility and coordinated response

Stand up a Cyber Threat Intelligence (CTI) capability — sourcing, curating, and operationalizing threat feeds and IOCs relevant to telco/satellite/NTN threat actors

Translate CTI into proactive detection content, threat hunting hypotheses, and risk briefings for leadership

Report SOC metrics and risk posture to Head of InfoSec and leadership; contribute to exec-level reporting

Support compliance evidence gathering for ISO 27001, NIS2, and other frameworks tied to detection and response controls

Good understanding of MITRE ATT&CK, FiGHT, D3FEND, IOC analysis, and threat detection.

Build automated/SOAR response on thematic incidents

8+ years in security operations/incident response, with 2+ years in a SOC leadership or team-lead role

Hands-on experience standing up or significantly maturing a SOC function, ideally in a scaling or greenfield environment

Deep familiarity with SIEM/EDR/XDR platforms (e.g., Splunk, Sentinel, CrowdStrike, SentinelOne) — deployment and tuning, not just operation

Strong incident response fundamentals: forensics, threat hunting, containment strategy

Experience building or running a Cyber Threat Intelligence function — feed sourcing/curation, IOC management, and threat actor tracking relevant to critical infrastructure

Understanding of cyber fusion center concepts — integrating SOC, CTI, IR, and vulnerability management functions for unified detection-to-response workflows

Experience building 24/7 or follow-the-sun coverage models

Familiarity with compliance frameworks relevant to telco/critical infrastructure (ISO 27001, NIS2, SOC 2)

People management experience — hiring, mentoring, and scaling a technical team

Strong stakeholder communication — comfortable presenting risk and incident status to executive leadership

Bonus: experience in telco, satellite, or other regulated critical-infrastructure environments

Skylo is an equal-opportunity employer and we celebrate diversity. We do not discriminate on the basis of race, religion, color, ancestry, national origin, caste, sex, sexual orientation, parent or caregiver status, political affiliation, gender, gender identity or expression, age, disability, medical condition, pregnancy, genetic makeup, marital status, or military service consistent with applicable federal, state, and local laws.

We are also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. Please let us know if you need assistance or accommodation due to a disability.