דרושים » אבטחת מידע וסייבר » Cyber Threat Intelligence Hunter (Unit 42)

The Cyber Threat Intelligence Hunter will sit within Unit 42 Managed Threat Hunting and support proactive, intelligence-led hunting across customer environments. This role combines hands-on threat hunting with cyber threat intelligence analysis, helping multinational organizations stay one step ahead of adversaries and cyber threats.
Key Responsibilities
Analyze public and private threat intelligence, Unit 42 research, adversary campaigns, malware activity, infrastructure, indicators, and TTPs.
Translate threat intelligence into actionable hunting hypotheses, investigation workflows, hunting queries, and customer-facing findings.
Execute existing threat hunting reports and hunting workflows, investigate results, and support timely customer reporting.
Investigate scheduled hunt detections and compose clear, professional reports when relevant.
Investigate hunting leads based on IOCs, threat intelligence, internal detections, customer telemetry, and emerging adversary behaviors.
Monitor the threat landscape and prepare initial context for emerging campaigns, enabling the global team to continue deeper investigation and hunting.
Collaborate with threat hunters, detection engineers, incident responders, MDR, and Unit 42 researchers to operationalize intelligence quickly and effectively.
Escalate major, unclear, or high-impact security events to the Threat Hunting leadership team when necessary.
Provide ongoing feedback on findings, hunting reports, queries, intelligence workflows, and operational processes to support continuous improvement.

We're looking for a Senior Principal Threat Hunter to serve as a senior technical leader within our Cyber Defense Team team.

This is a high impact individual contributor role, you won't manage people, but you'll influence how we hunt, investigate

and respond to threats across cloud and SaaS environments at scale.

You'll be the person who takes a weak signal, a piece of emerging intelligence, or an unusual customer activity pattern and turns it into a meaningful investigation, a proactive hunt, or a new detection opportunity.

You'll lead the most complex investigations, drive threat intelligence initiatives, and help define the hunting methodologies that guide our customers' security outcomes.

As one of the team's most senior practitioners, you'll act as a force multiplier across hunting, intelligence, and incident response functions, elevating technical standards, mentoring peers, and helping shape the future of our detection and response capabilities.

What You'll Do
- Design and execute proactive threat hunts across cloud and SaaS environments (AWS, Azure, GCP, Okta, M365), grounded in current intelligence and ATT&CK-mapped adversary behavior.
- Mature and operate a recurring threat intelligence reporting function, turning intel into hunt leads, detection opportunities, and customer-facing narratives.
- Lead incident response investigations during US business hours, from scoping through root cause; step into the Incident Commander role when required.
- Continuously monitor threat detections and deliver responsive services with thorough event analysis and judgement.
- Triage and investigate security alerts across cloud and SaaS environments, separating true threats from noise and surfacing detection gaps to the detection engineering team.
- Leverage automation and AI tooling to scale impact, and propose improvements for processes, workflows, products, and policies.
- PLUS: Exposure to detection engineering, tooling and automation development, or prior managed services (MSSP) experience.

Required Senior Intelligence Analyst, Threat Intelligence Delivery
About the job
In this role, being onsite and embedded with a customer several days per week, you will leverage our cyber threat intelligence to enable network defenders and customer Cyber Threat Intelligence (CTI) teams to defend against the threats they face. You will be supported and enabled by a network of colleagues and specialists right across Threat Intelligence and will contribute to our wealth of technical skills and CTI knowledge. You will have access to industry leading tooling and data and will work towards delivering on customer priority intelligence requirements. You will be supporting the customer's CTI defensive mission, helping their Security Operations Center (SOC), threat hunters, detection engineers, and CTI analysts counter threats and enable the safe and secure running of their networks and operations.
A recognized leader in dynamic cyber defense, threat intelligence and incident response services. Mandiant's cybersecurity expertise has earned the trust of security professionals and company executives around the world. Our unique combination of renowned frontline experience responding to some of the most complex breaches, nation-state grade threat intelligence, machine intelligence, and the industry's best security validation ensures that Mandiant knows more about today's advanced threats than anyone.
Responsibilities
Build an understanding of the customers' CTI requirements. Identify their needs and opportunities for deployment of CTI within their operations to have the greatest defensive impact.
Track, research and contribute CTI analysis within Threat Intelligence, of customer's priority threat concerns.
Enable customer SOC analysts and Hunt teams to deploy and leverage our CTI.
Generate CTI and perform analysis of customer data, taking their bespoke sources to identify threat activity, or to build and automate investigative workflows.
Support the integration of CTI into customer's security processes and technologies, including Security Information and Event Management (SIEM) and Threat Intelligence Platform (TIP) systems. Write intelligence reporting against customer requirements, appropriate for their intelligence analysts or executive readers.

The Cortex Threat Intelligence team is responsible for maintaining an up-to-date overview of the ever-changing threat landscape and its effects on the Cortex product suite. This includes the collection, analysis, and dissemination of technical threat intelligence from multiple internal and external sources. As part of this role, you will identify detection opportunities, automate threat intelligence processes, and develop tools and methodologies to increase team productivity. our company's Cortex XDR is a market-leading platform with an almost unparalleled telemetry data lake. Our team is deeply data-driven; it is the ideal environment for analysts who are enthusiastic about data mining, tracking threat actors, and deconstructing complex cyberattacks.
Key Responsibilities
Monitor the global threat landscape using diverse sources to proactively identify potential coverage gaps and improve Cortex XDRs defensive posture.
Perform in-depth research into cyberattack techniques to provide actionable insights and suggestions for improving product capabilities.
Leverage our company's telemetry datasets to identify emerging attack patterns and hunt for novel threats.
Design and propose robust detection logic across multiple operating systems (Windows, macOS, Linux).
Partner with cross-functional teams within our company to communicate findings and co-develop security enhancements.
Transform technical intelligence into high-impact deliverables, including customer-facing reports, research articles for the company blog, or presentations at international security conferences.

We are looking for an experienced Incident Responder to join our newly established team in Israel, and spread our power!
WHAT YOULL DO
Investigate real-world cyber-attacks on customers cloud environments and cloud workloads, understanding their root causes and the full scope of compromise, leveraging the platform.
Perform proactive threat hunting to identify undetected cyber-attacks and cloud threats within customer environments.
Collaborate with customer teams during engagements to effectively respond to threats.
Develop and deliver professional engagement reports, including high-level summaries and deep dives into technical findings.
Develop and document incident response methodologies, best practices, and standard operating procedures tailored to cloud environments and cloud workloads.
Collaborate with the threat research and engineering groups to refine and enhance incident response detections, tools, and features, based on real-world investigation experiences.

we are looking for a MXDR Analyst to join the team of cybersecurity analysts monitoring services 24/7. The role includes development of detection analyses, triage of alerts, investigation of security incidents, proactive threat hunting and enhancement of sensors and overall visibility status. The suitable candidate should be a team player with previous experience in SOC, SecOps or security monitoring, independent, and with a can-do attitude.
Responsibilities:
Working across all areas of SOC, including continuous monitoring and analysis, threat hunting, security compliance, security event auditing and analysis, rule development and tuning, and forensics.
Solving security incidents in accordance with defined service level agreements and objectives.
Prioritizing and differentiating between potential incidents and false alarms.
Addressing clients enquiries via phone, email, and live chat.
Working side-by-side with customers, providing insightful incident reports.
Working closely with peers and higher-tier analysts to ensure that your analysis work meets quality standards.
Identifying opportunities for improvement and automation within the MXDR Operation Lead, and leading efforts to operationalize ideas.
Identifying and offering solutions to gaps in current capabilities, visibility, and security posture.
Correlating information from disparate sources to develop novel detection methods.

We are looking for a DFIR Expert to join our team at our company. In this role, you will lead high-impact forensic investigations, drive incident response efforts, and shape the future of our DFIR service. You will serve as the highest escalation point, working hands-on to contain threats and protect our clients' environments.

What You ll Do
Investigate & Respond: Conduct deep-dive digital forensics investigations across file systems, memory, and networks. Leverage EDR, SIEM, firewalls, and diverse datasets to handle containment, eradication, and recovery.

Lead the Effort: Act as the technical and management lead during incidents, managing communication both internally and externally with clients.

Innovate & Automate: Develop custom tools to automate triage and accelerate the investigation process. Introduce and maintain systems to keep the team mission-ready.

Own the Service: Collaborate with pre-sales, account managers, and subcontractors to scale the DFIR service, expand customer reach, and drive business growth.

Deliver Clarity: Provide in-depth incident reports and comprehensive Root Cause Analysis.

Are you an innovative security researcher with a deep understanding of Linux systems and a passion for protecting modern environments? Do you want to lead the charge in securing enterprise networks against the latest threats?
We're looking for a skilled professional to join our team, focusing on the critical and rapidly evolving fields of Linux Security. You'll be a foundational member of a new and growing team dedicated to the blue ocean of detection, developing multiple new capabilities within the largest cybersecurity enterprise in the world.
This is a unique opportunity to apply your expertise and influence the future of threat prevention-helping us build cutting-edge security solutions from the ground up.
Key Responsibilitie
Play a pivotal role in shaping the future of our security solutions.
Enhance product effectiveness by designing advanced protection components and developing sophisticated detection rules.
Research Linux OS internals, virtualized environments, and malware behaviors to inform and strengthen our attack prevention mechanisms.
Apply advanced AI and big data approaches to investigate and analyze large-scale datasets across our client base.
Lead research on novel protection concepts and bring them to production-grade quality, serving as a subject matter expert.
Stay up to date with the latest attacker methodologies, APT campaigns, and TTPs targeting Linux systems.
Conduct static and dynamic reverse engineering of Linux malware to uncover new techniques and develop mitigation strategies.
Collaborate closely with engineering, product management, and other research teams to translate research findings into production features.

Join a team redefining cloud security operations across Cloud Detection & Response (CDR) and Cloud Security Posture Management (CSPM). Our team operates at the intersection of security, engineering, and large-scale cloud operations. We build products that help organizations detect threats faster, respond with confidence, continuously reduce risk, and secure modern cloud environments at scale. This is an opportunity to help shape the future of autonomous cloud defense by building technology that turns security signals into meaningful action.
Key Responsibilities
Help build the next generation of the Autonomous Cloud SOC by transforming detections, posture findings, and emerging threats into intelligent investigation and response workflows.
Design and build automated playbooks that investigate security signals, gather evidence, assess blast radius, validate risk, and guide or execute response actions.
Work across cloud control planes, identity systems, Kubernetes environments, network telemetry, and posture data to turn signals into high-confidence outcomes.
Leverage existing detections, continuously improve investigation logic, and ensure response workflows remain effective as cloud environments and attacker techniques evolve.

We are looking for a Cyber Threat Intelligence Analyst to be an integral part of our Intelligence teams, combining both cutting-edge technology and advanced threat intelligence analysis methodologies to deliver high-impact briefings to our customers
Requirement for 5 working days per week: Sunday to Thursday or Monday to Friday.
Key Responsibilities
Learning the customer needs and PIRs, configuring their tailored environments in the ERM intelligence platform and supporting the customers with tuning/training throughout engagement
Monitoring and analyzing threats targeting customers, or issues in their digital exposure, in order to produce actionable intelligence alerts and reports.
Investigating intelligence sources, threat actors, attack tools and techniques
Identifying and developing ERM data sources to collect the most relevant intelligence (darknet, forums, social media, marketplaces, etc.) as well as creating and maintaining avatars on these.
Developing the proprietary intelligence platform by surfacing new modules, capabilities and features
Joining meetings with prospects and clients to present deliverables.
Drive cooperation & feedback loops with other ERM teams.