Northwood is a modern space infrastructure company bringing the benefits of space to the masses through advanced communications technology. We are building a global network of phased array ground stations that enable real-time, reliable communication for satellite missions such as national security, global connectivity, and disaster response. With a vertically integrated approach, Northwood designs, builds, and rapidly deploys scalable systems that power the next generation of space missions. If you like solving complex challenges and seeing your work deployed around the world with real impact, Northwood is the place to do it.
Role
As Security Operations Lead, you will build and own Northwood's security operations function — standing up SOC capabilities, leading incident response, and developing the detection and threat hunting programs that protect mission-critical infrastructure. This is a senior leadership role for an operator who brings deep hands-on experience across SIEM engineering, EDR, and incident response, and who can build a team and program from the ground up in a highly regulated, dual-use environment.
You will develop detection content tailored to Northwood's hybrid on-premises and cloud infrastructure, building coverage across network security, identity, endpoint, and email security telemetry sources in a highly regulated dual-use environment. This role partners closely with the Security Engineering Lead and reports to the Head of Security.
Responsibilities
Security Operations & Monitoring
Build and operate Northwood's SOC function, including continuous monitoring of security events across AWS GovCloud, GCC, on-premises facilities, and endpoint environments.
Own alert triage, investigation, and escalation workflows, ensuring critical threats are identified and actioned with the urgency required of a mission-critical environment.
Monitor and analyze telemetry across network security, identity, endpoint, and email security platforms, ensuring comprehensive visibility into Northwood's on-premises, cloud, and perimeter environments.
Develop and maintain SOC operational metrics, reporting cadences, and dashboards for internal stakeholders and government customers.
Detection Engineering
Develop and continuously improve custom detection logic within Northwood's SIEM platform, including log source onboarding, correlation rule development, tuning, and coverage gap analysis.
Build behavioral analytics, UEBA rules, and threat hunting queries tailored to Northwood's infrastructure and adversary profiles targeting aerospace and defense.
Maintain detection content aligned to MITRE ATT&CK, ensuring coverage maps are current and gaps are systematically addressed.
Integrate threat intelligence feeds into detection workflows and brief stakeholders on emerging threats relevant to government and dual-use space communications infrastructure.
Incident Response & Forensics
Own security incidents end-to-end, from initial detection through containment, eradication, recovery, and post-incident review.
Conduct digital forensics and malware analysis using tools such as Volatility, YARA, and supporting utilities across Linux and Windows environments.
Develop and maintain incident response playbooks and escalation procedures, including communication protocols for government customers and mission-critical operations.
Lead tabletop exercises and incident response drills to validate playbook effectiveness and team readiness.
Threat Hunting & Intelligence
Proactively hunt for advanced persistent threats across Northwood's on-premises and cloud environments, developing and refining hunting methodologies as the threat landscape evolves.
Research adversary tactics, techniques, and procedures targeting aerospace, defense, and critical infrastructure, and translate findings into actionable detection and hardening improvements.
Maintain familiarity with government incident reporting requirements and ensure response procedures satisfy applicable regulatory obligations.
Automation & Tooling
Develop Python, PowerShell, or Bash automation for incident response workflows, threat hunting pipelines, and security orchestration across Northwood's environment.
Build and maintain SOAR playbooks and automated response actions to reduce mean time to respond and minimize manual analyst burden.
Collaborate with the Security Engineering Lead to ensure SOC tooling integrations across SIEM, EDR, email security, and identity platforms are maintained and continuously improved.
Team Leadership
Hire, mentor, and develop security operations analysts and engineers as the team scales.
Define SOC operating procedures, analyst workflows, and on-call responsibilities to ensure consistent operational coverage.
Serve as a senior security subject-matter expert in cross-functional collaboration with network engineering, infrastructure, and compliance teams.
Basic Qualifications
5+ years of hands-on SOC operations, incident response, or threat hunting experience, with demonstrated experience in a technical leadership capacity.
Hands-on experience building and operating SIEM platforms, including custom detection rule development, log source onboarding, and advanced query development.
Experience with EDR platforms, including alert triage, policy management, and forensic investigation workflows.
Digital forensics and malware analysis proficiency, including tools such as Volatility and YARA.
Proficiency in Python, PowerShell, or Bash for security automation and threat hunting workflows.
Experience building and maintaining UEBA capabilities for insider risk detection and anomalous behavior identification.
Strong Linux forensics and log analysis skills across distributed systems.
Working knowledge of threat intelligence frameworks including MITRE ATT&CK and the Diamond Model.
Familiarity with compliance frameworks relevant to government environments, including NIST 800-171, CMMC, and DFARS incident reporting requirements.
Ability to obtain and maintain a TS/SCI clearance.
U.S. citizenship or status as a lawful permanent resident required to conform with ITAR export regulations.
Preferred Qualifications
Active TS clearance or higher.
Familiarity with Northwood's core security stack, including FortiGate firewall infrastructure, Cloudflare Zero Trust, Okta, CrowdStrike or SentinelOne EDR, and email security platforms such as Proofpoint or Sublime Security.
Experience with cloud security monitoring in AWS GovCloud and Microsoft GCC environments.
Hands-on experience with SOAR platforms and automated response workflow development.
Background in aerospace, defense, critical infrastructure, or other highly regulated security operations environments.
Experience with threat hunting in air-gapped or compliance-constrained environments.
Familiarity with government incident reporting requirements and procedures including DFARS 252.204-7012.
Certifications such as GCIH, GCFA, GNFA, or equivalent incident response credentials.
ITAR compliance experience.
Additional Requirements
This position requires successfully obtaining and maintaining a Top Secret Security Clearance as a condition of employment. While the clearance may not be immediately necessary upon hire, we encourage you to initiate the application process promptly upon accepting this offer. Your ability to secure the necessary clearance is essential for fulfilling key responsibilities of the role. Should you be unable to obtain it, Northwood Space reserves the right to modify or terminate your employment to align with optional needs.
Additional Information:
If you need a reasonable accommodation as part of your application for employment or interviews with us, please let us know.
To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.
Northwood Space is an Equal Opportunity Employer; employment with Northwood Space is governed on the basis of merit, competence and qualifications and will not be influenced in any manner by race, color, religion, gender, national origin/ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability or any other legally protected status.