דרושים » אבטחת מידע וסייבר » Security Operations Team Lead - Israel

We are looking for a senior, hands-on Security Operations Lead to build, mature, and operate Zenitys detection, response, and corporate security capabilities. You will own the engineering, workflows, and processes that keep Zenity secure day-to-day, while continuously improving visibility, automation, and operational resilience across both corporate and production environments. This role requires a technical operator who can architect scalable detection and response pipelines, manage endpoint and identity security controls, streamline GTM security enablement, and collaborate across the company to reduce risk. You will balance strategic direction with hands-on execution-ensuring threats are identified quickly, incidents are handled effectively, and the organizations operational security posture remains strong as Zenity grows.
Responsibilities:
Own and mature Zenitys Detection & Response program, including alerting, triage workflows, incident playbooks, and end-to-end response processes.
Build and maintain detection logic, integrations, and automation across logging, SIEM, EDR, cloud telemetry, and internal monitoring systems.
Lead incident investigations, coordinate response across engineering and business teams, and ensure clear communication and post-incident reviews.
Manage Zenitys Corporate Security Program, including identity and access management, endpoint posture management, corporate data security controls, and DLP practices.
Oversee privileged access workflows and JIT access for corporate and production systems in alignment with least-privilege principles.
Partner with engineering teams to ensure production environments maintain strong security baselines, logging, and monitoring coverage.
Collaborate with GTM/Sales teams to support Security Enablement, including third-party security questionnaires, customer assurance needs, and auditor inquiries.
Build automation-first operational processes that reduce manual overhead and provide consistent, repeatable security outcomes.
Develop and refine detection and response runbooks, escalation paths, and cross-team coordination models.
Maintain and improve incident and operational metrics, dashboards, and KPIs to measure operational efficiency and threat coverage.
Drive the intake and prioritization of security operations requests through Jira and internal workflows.
Work closely with Product Security, Cloud/DevOps, and GRC to ensure shared visibility and aligned operational practices.
Identify operational security gaps, propose improvements, and lead implementation efforts across tooling, processes, and controls.
Promote a culture of proactive detection, fast response, and shared responsibility for organizational security.

We are looking for an experienced Security Engineer to join our security operations team with a strong focus on detection and response.
This is a unique opportunity to leverage your threat detection and response experience and build some of the foundational systems and services to keep our infrastructure free from malicious actors and threats. You will partner closely with all engineering teams, IT administrators, and compliance analysts to ensure that we maintain sufficient visibility into our environments and develop effective programs and practices to ensure that our environments are always secure. Tooling and automation will be key to success as we scale our environments to meet customer demand.
What You Will Do:
Collaborate with different teams for building and setting up pipelines needed to gather relevant security telemetry.
Build and maintain an effective and scalable security monitoring infrastructure solution.
Develop detection strategies to identify anomalous activity and ensure that our critical infrastructure and services operate in a safe environment.
Triage alerts and drive security incidents to closure while reducing their potential impact to Semperis.
Build processes and workflows to triage security alerts and respond to real incidents.
Research new threat attack vectors and ensure that our detection and response capability is in line with the current threat landscape.
Proactively improve the quality of our detection rules and strive to eliminate classes of issues by working directly with engineering teams.
Contribute to strategy, risk management, and prioritization for all efforts around detection and response.
Collaborate with the compliance team to maintain and audit security controls and processes, ensure compliance with relevant security frameworks and certifications.
Pragmatic implementing business-focused controls to safeguard the companys multi-cloud entities.

Required Security Incident Response Group Lead - (250000G4)
What will you do?
A global provider of cybersecurity protection solutions for networks and applications. We are looking to enhance our Cloud Services, the fastest growing business, in key markets.
Security operation leadership - Oversee the daily operation by leading projects & processes, tracking tasks & progress, and mentoring of a global Incident Response (IR) group that is specialized in detection & mitigation of various network threats, such as Denial-of-service attacks, application server-side & client-side threats, botnets, and more.
Incident response leadership - Oversee & coordinate RT security incidents globally by maintaining & developing solid IR processes & playbooks, crisis management & de-escalation techniques, lead escalation calls, and identify & improve gaps in technical & operational procedures among the global security group.
Global IR team leadership - Lead and mentor a multidisciplinary cloud security group consists of security IR analysts & security experts, fostering a collaborative and high-performance culture, oversee the global recruitment & training process of new employees, and develop & maintain high performance teams with deep technical knowledge, customer orientation, and operational attitude.
Customer engagement - Ensure customer's SLA & satisfaction, build and maintain strong relationship with customers & stakeholders, and maintain regular communication through meetings, reports, and updates to ensure stakeholders are informed about security initiatives, incident responses, and risk posture.
Strategic planning - Develop & execute roadmaps, strategies, and frameworks aligned with organizational goals.

We are seeking an experienced SOC Manager to lead our Security Operations Center (SOC), with full responsibility for detection, response, and operational excellence. This role combines hands-on technical leadership with people management, process ownership, and alignment to business risk.
The SOC Manager will be accountable for the effectiveness, maturity, and scalability of security operations across the organization.
What you will do?
Oversee day-to-day SOC operations, ensuring timely threat detection, incident response, and threat mitigation. Own day-to-day SOC operations, ensuring effective threat detection, incident response, and containment across all environments.
Develop and implement SOC policies, processes, and playbooks to improve security effectiveness.
Continuously evaluate and enhance SIEM configurations, alerting mechanisms, and automation. Continuously optimize SIEM content, alert quality, detection coverage, and automation capabilities.
Team Management & Training- Recruit, mentor, and manage a team of SOC analysts and incident responders.
Lead incident investigation, containment, and remediation efforts, coordinating with internal teams and external partners.
Align security operations with MITRE ATT&CK, NIST, and other cybersecurity frameworks.
Produce clear, executive-level incident reporting and risk summaries for security leadership and stakeholders.
Stay updated on emerging threats, attack techniques, and security technologies to drive continuous improvements.

we are seeking an Incident Response Lead to own and mature the companys global cyber incident response capability. This role sits within the CISO Office and is accountable for response execution, post-incident learning, and executive-level coordination across our companys cloud, infrastructure, and platform environments.
The Incident Response Lead will act as the single accountable owner for high-severity security incidents, ensuring rapid containment, accurate impact assessment, regulatory-compliant communications, and continuous improvement of detection and response capabilities.
This role requires deep technical expertise, strong crisis leadership, and the ability to operate under pressure in highly regulated, high-availability environments.
Key Responsibilities
Incident Response Leadership
Lead and coordinate of security incidents across our companys cloud, infrastructure, and corporate environments.
Act as Incident Commander during major incidents, driving containment, eradication, and recovery efforts.
Support and maintain clear incident classification, escalation, and decision-making frameworks.
Ensure 24/7 readiness through on-call structures, runbooks, and playbooks.
Detection, Triage, and Investigation
Oversee advanced incident triage and forensic investigations across:
Cloud platforms
Network and perimeter security
Identity and access systems
Supply chain and third-party risks
Partner with SOC, Threat Intelligence, and Threat Hunting teams to improve detection fidelity and reduce MTTR.
Ensure evidence handling meets legal, regulatory, and forensic standards.
Lead regulatory-ready incident documentation, timelines, and root cause analysis (RCA).
Support audits, regulatory inquiries, and executive reporting related to security incidents.
Executive & Cross-Functional Coordination
Serve as the primary incident response interface to:
CISO and executive leadership
Legal, Privacy, Compliance, and Communications teams
Infrastructure, Network, IT, Platform, and Engineering leadership
Deliver clear, factual, and risk-based incident briefings to senior leadership.
Support customer and partner communications when security incidents impact trust or service availability.
Program Development & Continuous Improvement
Support our companys incident response program, including:
Playbooks and runbooks
Tabletop exercises and simulations
Red/blue/purple team coordination
Drive lessons-learned processes and ensure findings result in measurable control improvements.
Define and track incident response KPIs (MTTD, MTTR, containment effectiveness).

As the Technical Director for Reactive Services, you will serve as a senior-level consultant and client advocate, providing expert guidance on all facets of cybersecurity and data breach response. You will deliver strategic and technical leadership to a diverse range of clients, helping them navigate complex security incidents. Your expertise will be critical in shaping response strategies and ensuring clients effectively mitigate and recover from cyber threats.
Key Responsibilities
Provide expert-level strategic and technical guidance to clients during active data breach response and cybersecurity incidents.
Lead complex client engagements from initial scoping and resource allocation through to technical execution and final reporting.
Apply deep knowledge of forensic processes, including chain of custody, and advanced computer and memory acquisition techniques.
Utilize industry-standard forensics tools (e.g., EnCase, FTK, SleuthKit, Volatility) for in-depth analysis across major operating systems.
Challenge curiously by maintaining hyper-current knowledge of the threat landscape, emerging vulnerabilities, and attacker TTPs to inform response strategies.
Conduct detailed analysis of malware, identify persistence mechanisms, and triage threats to determine root cause and impact.
Proactively collaborate with internal teams and client stakeholders, ensuring alignment and communicating clear, actionable findings.
Develop and automate scripts and processes to simplify and enhance the efficiency of incident response scenarios.

We are seeking a highly skilled and experienced Head of Application Security to join our dynamic team. This role is pivotal in driving the security of our software development lifecycle and ensuring the robustness of our applications against potential threats. The ideal candidate will have a strong background in secure software development practices, including SSDLC implementation, and a deep understanding of security risks & tools. This position reports directly to an R&D VP.
Key Responsibilities
Lead the application security team, providing strategic direction and mentorship.
Develop and implement a comprehensive Secure Software Development Lifecycle (SSDLC) framework.
Oversee the integration of security practices into all phases of the software development lifecycle, including CI/CD guardrails.
Conduct risk assessments and threat modeling to identify and mitigate potential security vulnerabilities.
Collaborate with development teams to ensure secure coding practices and adherence to security standards, while maintaining developer productivity.
Implement and manage security automation tools and processes to enhance the efficiency of security operations.
Stay up-to-date on the latest security trends, vulnerabilities, and technologies to continuously improve our security posture.
Provide expert guidance on security architecture and design for new and existing applications.
Lead incident response efforts related to application security breaches and vulnerabilities.
Foster a culture of security awareness and continuous improvement within the organization.

looking for a MXDR Analyst to join the team of cybersecurity analysts monitoring services 24/7. The role includes development of detection analyses, triage of alerts, investigation of security incidents, proactive threat hunting and enhancement of sensors and overall visibility status. The suitable candidate should be a team player with previous experience in SOC, SecOps or security monitoring, independent, and with a can-do attitude.



Responsibilities

Working across all areas of SOC, including continuous monitoring and analysis, threat hunting, security compliance, security event auditing and analysis, rule development and tuning, and forensics.
Solving security incidents in accordance with defined service level agreements and objectives.
Prioritizing and differentiating between potential incidents and false alarms.
Addressing clients enquiries via phone, email, and live chat.
Working side-by-side with customers, providing insightful incident reports.
Working closely with peers and higher-tier analysts to ensure that your analysis work meets quality standards.
Identifying opportunities for improvement and automation within the MXDR Operation Lead, and leading efforts to operationalize ideas.
Identifying and offering solutions to gaps in current capabilities, visibility, and security posture.
Correlating information from disparate sources to develop novel detection methods.

Systems Development Engineering (SDE) at our company is a role where you manage services and systems at scale. SDEs creatively put their engineering discipline to use automating the mundane and reducing toil. We dont just write code to fix bugs, but emphasize the development of tools and solutions that fix classes of problems. We know its hard to control what you cant measure - so we focus on observability: instrumenting first, then turning data into knowledge, and finally knowledge into action. We know that the operational efficiency of our company systems, services, virtual compute environments and the operating systems that power them impact the environment, not just the bottom line. We know that working together we can do more, and that community matters.
our company brings together people with a wide variety of backgrounds, experiences and perspectives. We encourage them to collaborate, think big and take risks in a blame-free environment. We promote self-direction to work on meaningful projects, while we also strive to create an environment that provides the support and mentorship needed to learn and grow.
Together we engineer and build the infrastructure, tools, access and telemetry for systems that enable orchestration of our company-scale services. Come build things that matter.
The Managed Services Technology team plays a vital role in the Managed Threat Defense service delivery life-cycle. We are responsible for provisioning Security Operations (SecOps) and third-party security technology. This role focuses on deploying and integrating customer security technologies.
In this role, you will collaborate with enterprise clients, customers, internal stakeholders, and cross-functional teams to quickly and accurately provision and integrate SecOps and other customer-managed security technologies.
Part of our company Cloud, Mandiant is a recognized leader in dynamic cyber defense, threat intelligence and incident response services. Mandiant's cybersecurity expertise has earned the trust of security professionals and company executives around the world. Our unique combination of renowned frontline experience responding to some of the most complex breaches, nation-state grade threat intelligence, machine intelligence, and the industry's best security validation ensures that Mandiant knows more about today's advanced threats than anyone.
Responsibilities
Oversee the security technology provisioning lifecycle for new and existing customers.
Develop technical implementation plans based on customer expectations and shared information.
Facilitate project management and technical support during onboarding. Collaborate closely with customers and internal teams.
Collaborate with customers to triage and implement remediations and recommendations.
Document all implementation details and collaboration meeting notes in the internal tracking system.

We are looking for an experienced Security Lead to join our team and play a key role in securing and scaling our production environments. This is a hands-on position with direct impact on system reliability, security posture, and operational excellence across the organization.

Responsibilities:

Own day-to-day security operations in a fast-moving, cloud-native environment

Lead end-to-end incident detection, investigation, and response

Own and operate core security tooling (SIEM, CSPM, CNAPP, SSDLC, EDR)

Work closely with R&D, DevOps, and IT to bake security into development and operations

Build and maintain incident response runbooks and security playbooks

Own security compliance and GRC efforts, including SOC 2