Security Operations Manager

Runs the security operations centre at ARCO, the construction group, leading a team of Cybersecurity Analysts who handle monitoring, alert triage and incident response. The manager works closely with infrastructure, applications and GRC, and carries out a security strategy set by senior management.

The role is both strategic and hands-on. The manager oversees daily SOC activity, leads every security incident investigation through containment and remediation, and runs incident response exercises and post-mortems that trace root causes. They manage and tune the security stack, including SIEM, IDS/IPS, EDR, firewalls and threat intelligence platforms, keep runbooks and escalation playbooks current, and automate repetitive work. Vulnerability scanning, patching and hardening are done with infrastructure partners, and audit and compliance work against NIST 800-171, CMMC and NIST CSF with the GRC team. The manager also builds metrics on risk and SOC performance, briefs leadership on incidents in business terms, and makes sure awareness training and phishing simulations take place.

ARCO wants seven to ten years in security operations or engineering with monitoring and incident response at the core, experience leading and developing people, hands-on use of SIEM, EDR, SOAR and similar tools, and Azure or AWS exposure. CISSP, CISM, GIAC or CySA+ is preferred. US citizenship is required, and travel is up to 10 percent. The role is based in St. Louis.