דרושים » אבטחת מידע וסייבר » Senior Security Researcher SOC & Incident Response

Were hiring our first Product Security Researcher (SOC & Incident Response) to join our newly formed Security Research function- a critical role for someone passionate about advancing real-world SOC operations with deep cybersecurity expertise.
We are building a world-class Security Research team that will power our advanced product with deep, actionable cybersecurity expertise. This team will serve as the Subject Matter Experts (SMEs) behind our triage and Incident Response platform, defining logic, contributing threat intelligence, building use-case coverage, and continuously optimizing detection and investigation workflows.
Youll collaborate closely with Product, Engineering, and Customer Success to ensure our Auto-Triage engine reflects the latest adversarial techniques and real-world SOC operations.

Responsibilities:
Serve as a domain expert in SOC workflows, alert triage, and incident response.
Design and maintain triage logic, playbook blueprints, AI Agents and more for responding to security events.
Develop and maintain alert enrichment, correlation, and classification rules across multiple data sources (EDR, SIEM, Identity, etc.).
Collaborate with product teams to define use cases, threat coverage, and analyst workflows.
Analyze real-world alerts, telemetry, and incident data to enhance product accuracy, reduce false positives and improve incident handling.
Evaluate and curate threat intelligence feeds and sources to support automated decision-making.
Conduct post-incident reviews to extract lessons and update triage logic accordingly.
Stay current with emerging threats, attacker TTPs, MITRE ATT&CK, and other frameworks.
Assist with quality assurance, testing, and validation of triage logic before deployment.

As a Cloud Security Analyst, you will join our global SOC team. A small, highly technical team that owns key parts of Vias security operations. This role is perfect for someone who is motivated and eager to make an impact, and who wants to take meaningful ownership in a cloud-native environment.You will investigate real incidents, improve detections, collaborate with engineering, support AI initiatives, and strengthen Vias security posture end-to-end.

What Youll Do:

Monitor, investigate, and respond to security events across cloud and SaaS environments
Tune detections, signatures, and guardrails to reduce noise and improve accuracy
Develop and maintain SOC playbooks, processes, and response guidelines
Perform intrusion analysis and contribute to threat intelligence correlation
Conduct proactive threat hunting and surface emerging risks
Lead hands-on technical investigations and incident containment
Work with SecOps engineers to design automated remediation flows
Build dashboards, advanced alerts, and visibility for critical events
Continuously improve SOC capabilities by bringing new ideas and approaches

Are you passionate about innovation in cloud security and want to redefine how Security Operations Centers (SOCs) leverage both agent and agentless technologies for detection and response? Join our cutting-edge Security Research team and lead the development of next-generation cloud detection and response solutions. In this role, you will define detection use cases, analyze threat data, and create advanced security content to protect against evolving threats in cloud environments. Be part of an exceptional team of researchers and engineers dedicated to safeguarding our customers. This is your opportunity to dive into pioneering technologies that integrate cloud security with innovative detection methodologies in a world-leading cybersecurity company.
Your Impact
Conduct ongoing research to identify and develop new detection techniques for both agent-based and agentless cloud technologies
Stay ahead of Advanced Threats, attacker methodologies, and Tactics, Techniques, and Procedures (TTPs) to ensure our solutions remain proactive and effective against emerging threats
Simulate real-world attack scenarios in lab settings, performing in-depth analysis of adversarial behaviors and their implications for cloud security
Foster a collaborative atmosphere within an experienced, diverse, and supportive research team, driving forward new and innovative ideas in cloud detection and response.

Unit 42s Managed Detection and Response (MDR) service is growing fast, and were building a customer-centric team that blends technical expertise with direct customer engagement. As a Customer Focus Analyst, youll act as the front line of communication between our MDR analysts and our customers, helping bridge the gap between incident response and customer understanding.
Youll not only support investigations and incident triage, but also help onboard customers, answer technical questions about reports, alerts, and the service, and manage ongoing communications to ensure clarity, alignment, and satisfaction.
This role is ideal for someone who is technical at their core, but enjoys customer interactions, driving clarity, and ensuring our partners feel confident and supported in their cybersecurity journey.
Key Responsibilities
Be part of a customer-focused sub-function of the Unit 42 MDR team, dedicated to proactive communication and technical guidance
Support onboarding activities for new customers
Monitor incoming communication from customers (e.g., via email, comments), triage and route issues as needed, and answer technical questions around reports, alerts, and recommendations
Collaborate with MDR analysts to ensure the customers technical questions about incidents or threats are fully addressed
Own the customer communication lifecycle during ongoing incidents ensure timely updates, clarity, and alignment on next steps
Help drive consistency and quality in how incidents and threat intelligence are communicated externally
Escalate and advocate for customer issues internally across Product, Engineering, and the broader Unit 42 team.

Are you excited about leading a team of researchers who are redefining how cloud security is automated? Do you want to shape the future of an Autonomous SOC by building the next generation of remediation and response content?
As the Cloud Cybersecurity Research Manager, you will lead a team of talented researchers creating autonomous remediation plans for cloud runtime and posture issues. You will drive innovation, mentor researchers, and ensure our automation content is precise, safe, and impactful. This role combines hands-on technical knowledge with strategic leadership, empowering your team to deliver solutions that protect customers at scale.
Your Impact
Lead and mentor a team of cloud security researchers, fostering technical excellence, innovation, and collaboration
Define research priorities and guide the design of robust, testable, and autonomous remediation plans for cloud runtime and posture issues (CSPM, DSPM, CIEM, CNAPP, IAM, etc.)
Ensure high-quality delivery of SOAR playbooks and automation content aligned with customer needs and company vision
Collaborate with product, engineering, and threat research teams to maximize the impact of remediation content
Establish processes, KPIs, and best practices to continuously improve research output, playbook quality, and operational efficiency
Stay up to date with attacker TTPs, cloud-native threats, and emerging technologies to guide team direction.

Are you passionate about advancing automation in identity security? Do you thrive at the intersection of research, innovation, and large-scale impact? As a Senior Security Researcher, you will drive the design of autonomous response strategies to counter identity-based threats, misconfigurations, and abuse scenarios. Your research will directly shape the Cortex platforms ability to remediate identity-driven attacks, ensuring effective, safe, and scalable automation for our customers. You will collaborate with world-class researchers and engineers to deliver on the vision of the Autonomous SOC.
Your Impact
Lead the design and implementation of robust, testable, and safe remediation playbooks for identity-related threats (e.g., privilege escalation, credential abuse, lateral movement, IAM misconfigurations).
Conduct deep research on adversary TTPs targeting identity systems and translate insights into automated detection and response mechanisms.
Drive innovation in identity security automation by applying data analysis, modeling, and programming to refine remediation strategies.
Serve as a subject-matter expert and mentor within the research group, elevating the teams overall expertise in identity security.
Stay ahead of evolving identity-based attack vectors, cloud-native identity risks, and advanced adversary tradecraft to ensure our automation keeps pace with threats.

Were looking for an Automation Security Analyst whos eager to help shape and strengthen our And strengthen our SOC and IR. Youll play a key role in developing a dynamic and evolving security environment, driving efforts to automate alert handling and streamline incident response. If youre passionate about cybersecurity, automation, and creative problem-solving, wed love to hear from you.

Responsibilities:
Develop and implement automation workflows to improve alert investigation and response efficiency.
Investigate and respond to security alerts, ensuring timely and effective resolution of incidents.
Identify false positives and collaborate on SIEM/SOAR tuning to enhance detection accuracy.
Apply creative, out-of-the-box thinking to solve complex security challenges and strengthen SOC capabilities.
Handle phishing incidents, including analysis, containment, and mitigation efforts.
Work closely with IT and DevOps teams to resolve security issues and promote best practices.
Contribute to the growth and maturity of a dynamic SOC team.
Participate in on-call rotations for incident response outside of regular working hours.

Were looking for a hands-on AI Cyber Intelligence Engineer - in the domain of network attack surface. Someone who lives and breathes network security, loves exploring how attackers move through real environments, and is excited to shape how AI can automate and extend that process.
In this role, youll analzse real-world environments, identify potential attack vectors, and work closely with our AI engineering teams to translate your domain expertise into actionable, intelligent workflows. Youll play a key role in guiding how our platform learns to think and act like a top-tier security analyst.
Responsibilities
Analyse complex network environments, configurations, and security controls to map topologies and identify weaknesses or lateral movement paths.
Research and model attacker behaviour and detection strategies, guiding how AI systems reason about threat scenarios.
Collaborate with AI engineers to shape agentic flows - defining the logic, prompts, and reasoning patterns that replicate expert investigative thinking.
Conduct hands-on assessments of enterprise networks to validate and improve automated detection and response capabilities.
Stay current on evolving attack tactics, network security technologies, and AI-driven threat detection trends.
Act as a security subject matter expert for cross-functional engineering teams.

We are looking for a Security Researcher to join our research group as part of a growing team developing Autopilot, an innovative product for autonomous investigation and response.
As a core member of the team, you'll go beyond research: youll research, design, and develop investigation modules that allow Autopilot to autonomously detect, investigate, and respond to advanced threats at a massive scale.
Youll analyze everything from new malware behaviors to attacker techniques and process activity in enterprise-scale networks, using data collected from across millions of endpoints. Your work will span identifying attack patterns and uncovering statistical anomalies, as well as validating that the system responds effectively to real-world attacks and APT campaigns using production data.
Your Impact
Research and implement new autonomous methods for investigating and responding to targeted attackers, using large-scale, diverse security datasets
Develop and design the graph-based algorithms that power autonomous investigation and decision-making capabilities
Design automated incident response by developing reusable logic that transforms raw security data and alerts into clear, actionable insights.
Leverage graph algorithms, AI techniques, and statistical methods to mimic and scale human security analyst workflows
Conduct deep, hands-on investigations into modern malware, APTs, and complex attack flows to inform detection and response logic
Stay up to date with attacker methodologies, tools, and techniques (TTPs), ensuring our product remains effective against evolving threats
Contribute to a collaborative, fast-paced research team, helping shape our research strategy, improve processes, and continuously enhance the product.

Are you passionate about taking automation to the next level? Do you live and breathe the cyber security world? Do you want to take part in an innovative and disruptive team that will have an impact on the lives of many customers?
As a Cloud Cybersecurity Researcher, you will design and implement remediation strategies for cloud runtime and posture issues, ensuring responses are as autonomous, effective, and safe as possible. You will collaborate with leading security experts, leverage cutting-edge technologies, and contribute to the vision of an Autonomous SOC.
Your Impact
Develop robust, testable, and safe remediation plans for cloud runtime and posture issues (CSPM, DSPM, CIEM, CNAPP, IAM, etc.)
Conduct in-depth research to identify attacker TTPs and cloud misconfiguration risks, and translate findings into automated response playbooks
Apply data analysis, programming, and modeling techniques to evaluate and optimize remediation approaches
Collaborate within a diverse research group to continuously improve automation processes and methodologies
Stay ahead of evolving threats, including cloud-native attack vectors and advanced adversary tradecraft.