Security Operations Manager

Runs the security operations centre for ARCO, the family of construction companies, from St. Louis, leading a team of cybersecurity analysts who handle monitoring, triage and incident response. The role is both strategic and hands-on and works closely with infrastructure, applications and GRC partners.

The manager oversees daily SOC operations, leads every security incident from investigation through containment and remediation, runs exercises and postmortems, and keeps runbooks, escalation paths and playbooks current. Responsibilities also include managing and tuning SIEM, IDS/IPS, EDR, firewalls and threat intelligence tools, overseeing vulnerability scanning and remediation with infrastructure teams, supporting hardening and patching, building metrics and dashboards on risk and SOC performance, supporting NIST 800-171, CMMC and NIST CSF audits, and making sure awareness training and phishing simulations happen. Automating repetitive work and explaining risk to leadership in business terms are part of the job.

ARCO asks for seven to ten years in cybersecurity operations or engineering including monitoring and incident response, experience leading and developing people, and hands-on knowledge of SIEM, EDR, SOAR, vulnerability management and related tools. Azure or AWS experience and familiarity with NIST 800-171, CMMC and NIST CSF are expected, US citizenship is required, and CISSP, CISM, GIAC or CySA+ is preferred. Travel is up to 10%.