דרושים » אבטחת מידע וסייבר » Incident Response Team Leader

We are seeking a driven problem solver to join our Unit 42 MDR team.
Our team is responsible for customers internal security monitoring, threat hunting and incident response. As a Senior MDR, we will rely on you to manage a team of experts who detect and respond to cyber incidents facing customers internal business.
As a Senior, you will join a team of managers who overlook the Unit 42 MDR team to ensure premium delivery to our customers and also have a critical role in how the team works, but also be able to create new processes, methodologies and capabilities that the team requires.
Your Impact
Hire for and lead a team of MDR Analysts working globally, guide the team, create and improve processes, methodologies and capabilities that the team requires to work effectively
Lead a team that analyzes incidents from real customer environments to identify ongoing threats to customer environments
Provide critical feedback to the different product, research and engineering and threat hunting teams to help improve the products for the entire companys customer base
Work closely with Security Research, Threat Intelligence and Threat Hunting teams to remediate and detect new emerging threats.

Are you passionate about innovation in cloud security and want to redefine how Security Operations Centers (SOCs) leverage both agent and agentless technologies for detection and response? Join our cutting-edge Security Research team and lead the development of next-generation cloud detection and response solutions. In this role, you will define detection use cases, analyze threat data, and create advanced security content to protect against evolving threats in cloud environments. Be part of an exceptional team of researchers and engineers dedicated to safeguarding our customers. This is your opportunity to dive into pioneering technologies that integrate cloud security with innovative detection methodologies in a world-leading cybersecurity company.
Your Impact
Conduct ongoing research to identify and develop new detection techniques for both agent-based and agentless cloud technologies
Stay ahead of Advanced Threats, attacker methodologies, and Tactics, Techniques, and Procedures (TTPs) to ensure our solutions remain proactive and effective against emerging threats
Simulate real-world attack scenarios in lab settings, performing in-depth analysis of adversarial behaviors and their implications for cloud security
Foster a collaborative atmosphere within an experienced, diverse, and supportive research team, driving forward new and innovative ideas in cloud detection and response.

we are looking for a Cyber Security Engineer
As a Cyber Security Engineer , youll play a key role in protecting our global platform and ensuring the resilience of our systems against emerging threats. Youll be responsible for investigating and responding to security incidents, analyzing malware, and conducting threat hunting activities across cloud environments.
Youll collaborate closely with the Infosec team, engineers, and cross-functional stakeholders to detect, contain, and mitigate threats, while continuously improving our security posture.
As part of a strong, experienced team, youll contribute to design, shape and implement information security solutions, mentor others in best practices, and drive automation initiatives to streamline detection and response.
Responsibilities:
Develop and maintain automation scripts in Python to enhance SOC efficiency and incident response workflows.
Perform initial triage and assessment of security incidents, identifying threats and recommending mitigation strategies.
Conduct static and dynamic analysis to uncover malicious behaviours, code, and techniques.
Apply forensic methodologies to extract, analyze, and interpret digital evidence to support investigations and attribution.
Investigate and mitigate cloud-based threats, with a focus on AWS environments.
Collaborate with cross-functional teams to strengthen overall organizational security and ensure best practices.

looking for a MXDR Analyst to join the team of cybersecurity analysts monitoring services 24/7. The role includes development of detection analyses, triage of alerts, investigation of security incidents, proactive threat hunting and enhancement of sensors and overall visibility status. The suitable candidate should be a team player with previous experience in SOC, SecOps or security monitoring, independent, and with a can-do attitude.



Responsibilities

Working across all areas of SOC, including continuous monitoring and analysis, threat hunting, security compliance, security event auditing and analysis, rule development and tuning, and forensics.
Solving security incidents in accordance with defined service level agreements and objectives.
Prioritizing and differentiating between potential incidents and false alarms.
Addressing clients enquiries via phone, email, and live chat.
Working side-by-side with customers, providing insightful incident reports.
Working closely with peers and higher-tier analysts to ensure that your analysis work meets quality standards.
Identifying opportunities for improvement and automation within the MXDR Operation Lead, and leading efforts to operationalize ideas.
Identifying and offering solutions to gaps in current capabilities, visibility, and security posture.
Correlating information from disparate sources to develop novel detection methods.

We are looking for a SecOps Engineer to join our Security Operations team. In this role, you will help defend the organization end-to-end, from IT security to cloud security - while performing third-party and internal security reviews, handling incident response, conducting threat hunting, and supporting GenAI security work.

Responsibilities:
Design, operate, and improve security infrastructure by maintaining core controls, hardening systems, and leading cloud security efforts to address misconfigurations, vulnerabilities, and identity risks.
Monitor, investigate, and remediate security alerts and threats by performing DFIR, analyzing attack vectors, proactively hunting adversary activity, and leading incident response.
Perform security reviews of third-party vendors, SaaS platforms, and internal applications, assessing architectures, data flows, integrations, and risk exposure.
Defend the organization end-to-end across endpoints, identities, applications, and cloud by operating and advancing SecOps controls (SIEM/EDR/CSPM), building automations, enforcing best practices, and partnering cross-functionally to drive security outcomes.

This role is client-facing and requires the Principal Consultant to lead and produce deliverables based on reactive services client engagements. The Principal Consultant will work directly with multiple customers and key stakeholders (Admins, C-Suite, etc) to manage incident response engagements and provide guidance on longer term remediation.
Your Impact
Perform reactive incident response functions including but not limited to - host-based analysis functions through investigating Windows, Linux, and Mac OS X systems to identify Indicators of Compromise (IOCs)
Examine firewall, web, database, and other log sources to identify evidence of malicious activity
Investigate data breaches leveraging forensics tools including Encase, FTK, X-Ways, SIFT, Splunk, and custom Crypsis investigation tools to determine source of compromises and malicious activity that occurred in client environments
Manage incident response engagements to scope work, guide clients through forensic investigations, contain security incidents, and provide guidance on longer term remediation recommendations
Ability to perform travel requirements as needed to meet business demands (on average 20%)
Mentorship of team members in incident response and forensics best practices.

Technical Director, Reactive Services is a senior-level consulting position. The individual will provide expert-level guidance on all areas of cybersecurity and data breach response to Unit 42 clients across a wide array of industries, geographies, and organizational structures. They will be the clients advocate for cybersecurity and will provide strategic and technical leadership in this area.
Your Impact
Experience with forensic processes and procedures (chain of custody, computer acquisition techniques, and memory acquisition techniques)
Maintain hyper-current knowledge of extant vulnerabilities and threat landscape
Experience using forensics tools such as EnCase, FTK, SleuthKit, Volatility, etc.
Analysis experience and operational understanding of one or more major operating systems (Microsoft Windows, Linux, or Mac)
Knowledge of common malware persistence mechanisms
Experience identifying and triaging malware.

we are looking for an experienced Incident Responder to join our newly established team and spread the power of our company!
WHAT YOULL DO
Investigate real-world cyber-attacks on customers cloud environments and cloud workloads, understanding their root causes and the full scope of compromise, leveraging the company platform.
Perform proactive threat hunting to identify undetected cyber-attacks and cloud threats within customer environments.
Collaborate with customer teams during engagements to effectively respond to threats.
Develop and deliver professional engagement reports, including high-level summaries and deep dives into technical findings.
Develop and document incident response methodologies, best practices, and standard operating procedures tailored to cloud environments and cloud workloads.
Collaborate with the threat research and engineering groups to refine and enhance incident response detections, tools, and features, based on real-world investigation experiences.

We are looking for an experienced Security Engineer to join our security operations team with a strong focus on detection and response.

This is a unique opportunity to leverage your threat detection and response experience and build some of the foundational systems and services to keep our infrastructure free from malicious actors and threats. You will partner closely with all engineering teams, IT administrators, and compliance analysts to ensure that we maintain sufficient visibility into our environments and develop effective programs and practices to ensure that our environments are always secure. Tooling and automation will be key to success as we scale our environments to meet customer demand.



What You Will Do:

Collaborate with different teams for building and setting up pipelines needed to gather relevant security telemetry.

Build and maintain an effective and scalable security monitoring infrastructure solution.

Develop detection strategies to identify anomalous activity and ensure that our critical infrastructure and services operate in a safe environment.

Triage alerts and drive security incidents to closure while reducing their potential impact .

Build processes and workflows to triage security alerts and respond to real incidents.

Research new threat attack vectors and ensure that our detection and response capability is in line with the current threat landscape.

Proactively improve the quality of our detection rules and strive to eliminate classes of issues by working directly with engineering teams.

Contribute to strategy, risk management, and prioritization for all efforts around detection and response.

Collaborate with the compliance team to maintain and audit security controls and processes, ensure compliance with relevant security frameworks and certifications.

Pragmatic implementing business-focused controls to safeguard the companys multi-cloud entities.

Were looking for an Automation Security Analyst whos eager to help shape and strengthen our And strengthen our SOC and IR. Youll play a key role in developing a dynamic and evolving security environment, driving efforts to automate alert handling and streamline incident response. If youre passionate about cybersecurity, automation, and creative problem-solving, wed love to hear from you.

Responsibilities:
Develop and implement automation workflows to improve alert investigation and response efficiency.
Investigate and respond to security alerts, ensuring timely and effective resolution of incidents.
Identify false positives and collaborate on SIEM/SOAR tuning to enhance detection accuracy.
Apply creative, out-of-the-box thinking to solve complex security challenges and strengthen SOC capabilities.
Handle phishing incidents, including analysis, containment, and mitigation efforts.
Work closely with IT and DevOps teams to resolve security issues and promote best practices.
Contribute to the growth and maturity of a dynamic SOC team.
Participate in on-call rotations for incident response outside of regular working hours.