דרושים » אבטחת מידע וסייבר » one Taldor מגייסת אנליסט.ית אבטחת מידע Tier 2 למרכז הSOC בארגון ביטחוני במרכז!

You will be the only SOC analyst based in Israel, while the rest of the analyst team operates from the Philippines. You will act as the SOCs local anchor - the on-site technical counterpart for the Israel-based Cyber Security, IT, Operations, and R&D teams, and the escalation and knowledge bridge between them and the offshore shifts. The role calls for ownership, independence, and the appetite to build and improve, not only to operate.

Responsibilities

Monitoring and Detection: Continuously monitor SIEM, endpoint protection (EDR), IPS, mail security, CASB, cloud, and identity security solutions to identify potential threats.
Incident Response: Serve as one of the first levels of escalation for security incidents - investigate, contain, and drive resolution before escalating to the senior SecOps members, in accordance with defined procedures and SLAs.
Incident Coordination: Lead coordination of major incidents until ownership is transferred to the relevant SecOps, IT, Operations, or R&D team; ensure clear communication, escalation, and tracking of action items.
Threat Analysis: Analyze logs, network traffic, endpoint telemetry, and native (in-tool) alerts to determine root cause, scope, impact, and remediation steps.
SIEM and Detection Engineering: Own day-to-day operation of the SIEM - data onboarding and ingest pipelines, field mapping and data quality, dashboards and platform health - and write, tune, and maintain detection rules while measuring their effectiveness.
Exclusion and Exception Management: Own the exclusion and exception lifecycle across the security stack: review requests, assess risk, apply scoped, time-bound exclusions, and revalidate them periodically.
Automation and AI-Assisted Operations: Build and maintain automations across the SOC toolchain (enrichment, containment, ticketing, reporting), and design, implement, and validate AI/LLM-based workflows for alert triage, investigation support, and documentation - including guardrails and quality control of AI output.
Investigation Documentation: Create and maintain detailed incident tickets, including investigation audit trail, action items, and timelines.
Technical Leadership: Act as the senior operational reference for the analyst team: help prioritize workload, assure investigation quality, maintain consistent handling of incidents, escalations, and shift handovers, and mentor analysts on tooling and methodology.
Collaboration: Work closely with the Cyber Security team, IT, Operations, and R&D locally, and with the offshore SOC team across time zones.
Continuous Improvement: Drive improvements to detection logic, automation, operational runbooks, and shift handover documentation based on lessons learned from incidents.
Compliance and Reporting: Support reporting for compliance audits, management reviews, and threat intelligence updates.

e are currently seeking a dynamic Incident Response Analyst to contribute to the success of our rapidly growing business.



As an Incident Response Analyst, you will:

Investigate and respond to workspace security incidents across email, browser security and perimeter security domains.
Handle investigation requests submitted by customers
Perform targeted phishing analysis and investigation of new attack campaigns
Conduct threat hunting based on attack patterns, behaviors, and indicators
Build and improve detections based on new attack types, tactics, companies and trends
Collaborate with development and research teams to provide incident-driven insights, and develop new detection engines for identifying previously unknown attacks
Write professional blog posts based on incident investigations and attack trends, contributing to the companys research-driven content and public visibility
Work in rotating shifts as part of a 24/7 operation (including nights, weekends, and holidays)

The role is responsible for anticipating relevant threats, challenging defenses, identifying exploitable weaknesses, hunting for adversary activity that may evade existing controls, and converting findings into measurable security improvements. 

This is a hands-on leadership position for someone who combines offensive-security depth, threat-led thinking, strong operational judgment, and the ability to influence product, engineering, infrastructure, and security stakeholders. 



Your responsibilities will include:

Pillar strategy and leadership 

Define the Proactive Security strategy, operating model, roadmap, priorities, budget, and success measures in alignment with business objectives and threat profile. 
Build, lead, and develop high-performing Red Team, Penetration Testing, Threat Hunting, and Threat Intelligence teams. 
Create a unified intelligence-led program in which threat intelligence informs testing and hunting, and findings continuously improve defensive controls. 
Prioritize work based on crown jewels, material attack paths, emerging threats, major technology changes, incidents, and business risk. 
Establish clear team charters, engagement models, escalation paths, quality standards, and career-development frameworks. 
Provide the CISO and senior leadership with clear visibility into adversary exposure, validated weaknesses, emerging threats, and remediation progress. 
Red Team and adversary emulation 

Lead realistic, intelligence-led adversary simulations across cloud, identity, applications, infrastructure, endpoints, networks, and operational processes. 
Design campaigns that evaluate prevention, detection, response, escalation, and recovery capabilities against relevant threat scenarios. 
Develop and maintain adversary-emulation plans mapped to relevant threat actors, tactics, techniques, and procedures. 
Ensure every engagement operates under documented authorization, rules of engagement, safety controls, deconfliction procedures, and evidence-handling requirements. 
Deliver concise technical and executive reporting that explains demonstrated impact, attack paths, root causes, and prioritized improvements.