דרושים » אבטחת מידע וסייבר » SOC Analyst

We are seeking an Incident Response Engineer to join the IR team. This technical role focuses on active investigation, threat mitigation, and the continuous improvement of the security organizations posture through detection engineering and automation development.

The successful candidate will be responsible for the full lifecycle of security incidents, from initial triage to recovery. Beyond reactive response, this role involves tuning SIEM correlation rules and developing SOAR workflows to increase operational efficiency.

What Youll Be Doing
Incident Management: Execute the IR lifecycle (Triage, Containment, Eradication, Recovery) for complex security events.
Technical Investigation: Perform root cause analysis and forensic examination across Windows, Mac, and Linux environments.
Detection & Tuning: Collaborate with the IR team to create, test, and tune SIEM rules and dashboards to reduce false positives and improve visibility.
Automation Engineering: Build and refine SOAR playbooks and automated response actions to streamline repetitive investigation tasks.
Cloud Security: Monitor and mitigate cloud-native threats across Azure, AWS, and GCP environments.

As a CyOps Analyst, you will be investigating security alerts from the Cynet platform in order to detect threats and conduct live incident response engagements, investigating and analyzing programs and software using analysis programs to identify threats and classify malware based on previous threats and commonalities, investigating and issuing threat intelligence and malware analysis report. The SOC works closely with the Research team to perform tests and uncover new attack vectors to enhance, develop, and configure threat hunting tools. Additional responsibilities include:
* Identifying unknown threats for our global clients through advanced threat hunting services to complement the standard Security Operations Center services.
* Performing analysis and forensics on security threats, malware and attacks in the wild, using industry standard platforms and tools.

About Us:
Cynet is a leader in threat detection and response, designed to simplify security for organizations of all sizes. Our mission is to empower lean security teams and their partners with an AI-powered, unified platform that autonomously detects, protects, and responds to threats - backed by 24×7 security experts. With a Partner First mindset , we focus on helping customers and partners stay protected, operate confidently, and achieve their goals. Our vision is to give every organization true cybersecurity peace of mind, providing fast, accurate protection without the noise or complexity.

Required Senior Intelligence Analyst, Threat Intelligence Delivery
About the job
In this role, being onsite and embedded with a customer several days per week, you will leverage our cyber threat intelligence to enable network defenders and customer Cyber Threat Intelligence (CTI) teams to defend against the threats they face. You will be supported and enabled by a network of colleagues and specialists right across Threat Intelligence and will contribute to our wealth of technical skills and CTI knowledge. You will have access to industry leading tooling and data and will work towards delivering on customer priority intelligence requirements. You will be supporting the customer's CTI defensive mission, helping their Security Operations Center (SOC), threat hunters, detection engineers, and CTI analysts counter threats and enable the safe and secure running of their networks and operations.
A recognized leader in dynamic cyber defense, threat intelligence and incident response services. Mandiant's cybersecurity expertise has earned the trust of security professionals and company executives around the world. Our unique combination of renowned frontline experience responding to some of the most complex breaches, nation-state grade threat intelligence, machine intelligence, and the industry's best security validation ensures that Mandiant knows more about today's advanced threats than anyone.
Responsibilities
Build an understanding of the customers' CTI requirements. Identify their needs and opportunities for deployment of CTI within their operations to have the greatest defensive impact.
Track, research and contribute CTI analysis within Threat Intelligence, of customer's priority threat concerns.
Enable customer SOC analysts and Hunt teams to deploy and leverage our CTI.
Generate CTI and perform analysis of customer data, taking their bespoke sources to identify threat activity, or to build and automate investigative workflows.
Support the integration of CTI into customer's security processes and technologies, including Security Information and Event Management (SIEM) and Threat Intelligence Platform (TIP) systems. Write intelligence reporting against customer requirements, appropriate for their intelligence analysts or executive readers.

Our Security Operations (SecOps) team is seeking an experienced Security Operations and Incident Response Analyst to elevate our active defense capabilities. In this role, you will take a hands-on approach to our daily threat detection mission actively monitoring and triaging alerts while identifying creative ways to automate the security lifecycle.
This role is ideal for a seasoned analyst who has mastered the fundamentals of security monitoring and is ready to apply those insights to cloud security and detection engineering. You will be an active participant in our daily monitoring operations, using that front-line visibility to proactively tune our alerting logic, eliminate noise, and build higher-fidelity detections.
Working within a collaborative, globally distributed team, you will partner with key stakeholders, hold a significant voice in shaping our tooling, and follow a structured career progression tailored to your professional growth.
What You'll Be Doing:
Monitor & Respond - Serve as a key responder across our cloud and corporate environments, actively triaging alerts, investigating active threats, collecting evidence, and driving incidents to swift containment.
Analyze Cloud Risks - Investigate cloud-native alerts, analyzing infrastructure context and telemetry to isolate, validate, and remediate active risks.
Collaborate Cross-Functionally - Partner with internal engineering and infrastructure teams when needed to coordinate containment, remediation, and post-incident root-cause analysis.
Optimize Detections & Playbooks - Collaborate with senior engineers to tune alerting logic, suppress noise, and develop higher-fidelity detection rules, while identifying opportunities to optimize automated playbooks for alert enrichment and triage.

The Cyber Threat Intelligence Hunter will sit within Unit 42 Managed Threat Hunting and support proactive, intelligence-led hunting across customer environments. This role combines hands-on threat hunting with cyber threat intelligence analysis, helping multinational organizations stay one step ahead of adversaries and cyber threats.
Key Responsibilities
Analyze public and private threat intelligence, Unit 42 research, adversary campaigns, malware activity, infrastructure, indicators, and TTPs.
Translate threat intelligence into actionable hunting hypotheses, investigation workflows, hunting queries, and customer-facing findings.
Execute existing threat hunting reports and hunting workflows, investigate results, and support timely customer reporting.
Investigate scheduled hunt detections and compose clear, professional reports when relevant.
Investigate hunting leads based on IOCs, threat intelligence, internal detections, customer telemetry, and emerging adversary behaviors.
Monitor the threat landscape and prepare initial context for emerging campaigns, enabling the global team to continue deeper investigation and hunting.
Collaborate with threat hunters, detection engineers, incident responders, MDR, and Unit 42 researchers to operationalize intelligence quickly and effectively.
Escalate major, unclear, or high-impact security events to the Threat Hunting leadership team when necessary.
Provide ongoing feedback on findings, hunting reports, queries, intelligence workflows, and operational processes to support continuous improvement.

The Cyber Threat Intelligence Hunter will sit within Unit 42 Managed Threat Hunting and support proactive, intelligence-led hunting across customer environments. This role combines hands-on threat hunting with cyber threat intelligence analysis, helping multinational organizations stay one step ahead of adversaries and cyber threats.
Key Responsibilities
Analyze public and private threat intelligence, Unit 42 research, adversary campaigns, malware activity, infrastructure, indicators, and TTPs.
Translate threat intelligence into actionable hunting hypotheses, investigation workflows, hunting queries, and customer-facing findings.
Execute existing threat hunting reports and hunting workflows, investigate results, and support timely customer reporting.
Investigate scheduled hunt detections and compose clear, professional reports when relevant.
Investigate hunting leads based on IOCs, threat intelligence, internal detections, customer telemetry, and emerging adversary behaviors.
Monitor the threat landscape and prepare initial context for emerging campaigns, enabling the global team to continue deeper investigation and hunting.
Collaborate with threat hunters, detection engineers, incident responders, MDR, and Unit 42 researchers to operationalize intelligence quickly and effectively.
Escalate major, unclear, or high-impact security events to the Threat Hunting leadership team when necessary.
Provide ongoing feedback on findings, hunting reports, queries, intelligence workflows, and operational processes to support continuous improvement.

Are you an innovative security researcher with a deep understanding of Linux systems and a passion for protecting modern environments? Do you want to lead the charge in securing enterprise networks against the latest threats?
We're looking for a skilled professional to join our team, focusing on the critical and rapidly evolving fields of Linux Security. You'll be a foundational member of a new and growing team dedicated to the blue ocean of detection, developing multiple new capabilities within the largest cybersecurity enterprise in the world.
This is a unique opportunity to apply your expertise and influence the future of threat prevention-helping us build cutting-edge security solutions from the ground up.
Key Responsibilitie
Play a pivotal role in shaping the future of our security solutions.
Enhance product effectiveness by designing advanced protection components and developing sophisticated detection rules.
Research Linux OS internals, virtualized environments, and malware behaviors to inform and strengthen our attack prevention mechanisms.
Apply advanced AI and big data approaches to investigate and analyze large-scale datasets across our client base.
Lead research on novel protection concepts and bring them to production-grade quality, serving as a subject matter expert.
Stay up to date with the latest attacker methodologies, APT campaigns, and TTPs targeting Linux systems.
Conduct static and dynamic reverse engineering of Linux malware to uncover new techniques and develop mitigation strategies.
Collaborate closely with engineering, product management, and other research teams to translate research findings into production features.

We are looking for a Identity Security Analyst who will focus on investigating and resolving customer-reported security bugs. In this role, youll sit at the intersection of security research, product engineering, and customer success: youll reproduce issues, analyze impact and root cause, coordinate fixes with R&D, and communicate findings back to customers in a clear, actionable way.

This is a hands-on, technical position ideal for someone who enjoys debugging, incident-style investigations, and direct customer impact.

Key Responsibilities

Bug Triage & Investigation

Review and prioritize customer-reported security bugs (vulnerabilities, false positives, detection gaps, performance/coverage issues).

Reproduce issues in lab environments using customer-provided data, logs, and configurations.

Validate whether a bug is product defect, configuration issue, environmental limitation, or expected behavior.

Security Analysis

Analyze suspected vulnerabilities, misconfigurations, or detection gaps to determine impact, severity, and likelihood.

Correlate product behavior with attack techniques (e.g., MITRE ATT&CK, AD / identity attacks, NTLM relay, Kerberos abuse).

Perform log and event analysis (Windows Security / Sysmon / AD / LDAP / application logs) to understand bug context and side effects.

Resolution & Fix Coordination

Work closely with R&D / engineering teams to:

Provide clear reproduction steps, data, and technical context.

Propose mitigations and contribute to detection or logic fixes.

Verify hotfixes and releases against customer scenarios.

Track bugs through their full lifecycle to ensure timely resolution and high SLA adherence.

Customer Communication

Collaborate with Support, Customer Success, and SEs to:

Explain root cause and resolution in customer-friendly language.

Provide interim workarounds or configuration guidance when needed.

Contribute to knowledge base articles, runbooks, and best-practice guides.

Quality & Continuous Improvement

Identify recurring patterns in customer bugs and propose long-term product or process improvements.

Help refine internal monitoring, alerting, and testing for security-sensitive components.

Contribute to test cases and validation criteria for new features from a security QA perspective.

We are looking for a Compliance Analyst to join the CISO team. Reporting to the GRC Team Leader, you will fulfill an essential role, joining the team in accomplishing important Compliance projects, ensuring that all our systems and products are safe and meet the required standard.
What will you actually be doing?
Track enterprise compliance across multiple security frameworks including security, privacy and AI frameworks (ISO, SOC, etc) and maintain up-to-date records of requirements and corresponding mitigating controls.
Continuous monitoring of internal security processes to ensure compliance, and liaise with IT and business stakeholders to confirm current security arrangements and maintain systems security process.
Assist with the education and awareness programs to promote security and privacy in the company.
Creatively overcome obstacles so that the Compliance Controls will continuously operate alongside the business activities.
Review proposed changes on an ongoing basis to determine the impact on security and privacy.

Our global operations continue to expand, and were looking for a Incident Management Analyst to help ensure the stability and reliability of our global IT services.
As a key member of the IT Operations team, youll support the rapid response and coordination of critical IT incidents. This role is ideal for someone who thrives in fast-paced environments, communicates clearly under pressure, and enjoys working cross-functionally to solve complex operational challenges.
Youll work closely with technical teams, stakeholders, and leadership to ensure incidents are managed efficiently, communication flows smoothly, and services are restored as quickly as possible. Your work will play a key role in maintaining service continuity and minimizing business impact.

What Youll Do

Identify, log, and classify major IT incidents reported by internal teams or external users
Coordinate response efforts by engaging appropriate technical teams and vendors to diagnose and resolve incidents,coordination calls and document actions, updates, and timelines
Track incidents ,provide a clear and timely communication between technical teams, business stakeholders, and leadership during major incidents. Along with root cause analyses (RCAs), including performance incidents reports,
Assist in preparing RCA reports and ensure documentation and communication are completed as required, Be a contribute to knowledge base articles.
Support daily review meetings to discuss recent and ongoing high-priority incidents and operational work
Follow established Major Incident and Change Management processes, policies, and tools
Generate reports, dashboards, and performance metrics for operational and leadership reviews
Support process adoption and assist with training or guidance related to incident management practices