Cybersecurity Operations Engineer

About the role

The Cybersecurity Operations Engineer will act as the operational bridge between Intuitive Machines and its Managed Security Services Provider (MSSP).

Responsibilities

• SOC Coordination & Incident Management
• Act as liaison with MSSP, reviewing Tier 1/2 alert summaries, validating findings with organizational context, and facilitating escalations for hands-on resolution.
• Conduct real-time troubleshooting, log analysis, endpoint forensics, and containment actions on internal systems using tools like MS Defender, Wiz, and Tenable.
• Participate in incident response activities, ensuring timely communication with stakeholders and proper documentation of security events.
• Cross-functional coordination of incident response activities, ensuring timely containment, eradication, and recovery actions align with organizational priorities and compliance requirements.
• Endpoint Security & Tool Administration
• Support endpoint security solutions, including EDR solutions across the enterprise.
• Maintain operational access to security tools for investigation and response purposes.
• Perform regular health checks, updates, and optimization of security agents to ensure maximum coverage and performance across all organizational assets.
• Develop and maintain documentation for security agent configurations, deployment procedures, and troubleshooting workflows to support operational continuity.
• Continuous Improvement & Strategic Activities
• Participate in post-incident reviews and root cause analysis, documenting lessons learned to enhance response playbooks aligned with NIST 800-171/CMMC requirements.
• Contribute to the refinement of MSSP SLAs, escalation procedures, and operational runbooks.
• Generate compliance reports, executive briefings, and threat intelligence summaries for leadership and cross-functional teams (IT, Legal, Governance, Program Security).
• Monitor and report on MSSP performance metrics, contributing to quarterly vendor reviews and integrating findings into risk management workflows.
• Identify gaps in security coverage and recommend process improvements.
• Participate in tabletop exercises and security drills to validate response capabilities.
• Collaboration & Knowledge Sharing
• Integrate security findings into enterprise risk management workflows.
• Serve as security subject matter expert for internal projects and initiatives.
• Maintain currency with emerging threats, vulnerabilities, and security technologies relevant to the aerospace/defense sector.

Qualifications

• Must be a US Citizen with the ability to obtain a US Government security clearance.
• Bachelor's Degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent experience (four additional years of experience can be substituted for a degree).
• Eight years of hands-on experience in cybersecurity operations, incident response, or security engineering roles.
• Experience with endpoint protection platforms.
• Experience with cloud security concepts and tools (Wiz, AWS security services, or similar).
• Experience with SIEM platforms, log analysis, and security event correlation.
• Experience with NIST 800-171, CMMC, and DFARS cybersecurity requirements.

Preferred Qualifications

• Professional certifications such as CISSP, GCIH, GCFA, or CEH.
• Experience operating in aerospace, defense, or DoD/CMMC regulated environments.
• Scripting/automation skills (PowerShell, Python) for security operations tasks.
• Strong collaboration skills and ability to work effectively with cross-functional teams during complex security incidents.
• Experience with the M365 Security stack (Defender, Sentinel, MDC, Purview).
• Experience with Tenable One.
• Experience with centralized enterprise logging.
• Experience with network security, including IDS/IPS, firewalls, and security architecture.