דרושים » מחשבים ורשתות » SecOps IR Engineer

As a SecOps Lead , you will own the core of the security operations function: detection, response, automation, and the processes that connect them. You will guide incident response from first alert through post-mortem, keeping efforts structured and stakeholders informed along the way. You will shape how the team detects, triages, and resolves, and communicate that work clearly to leadership, engineering, and customers.

This is a hands-on role with broad ownership. You should be comfortable writing a detection rule, coordinating a live incident, and walking stakeholders through a post-incident review.

Key Responsibilities

Lead Incident Response: Own the end-to-end incident response lifecycle across infrastructure and enterprise browser platform, driving investigations, coordinating responders, and ensuring timely resolution and post-incident improvements.
Own the IR Framework: Build, maintain, and continuously improve incident response processes, including runbooks, severity definitions, escalation paths, on-call procedures, and communication standards.
Drive Detection Engineering: Design, implement, and continuously improve high-fidelity detections across SIEM, EDR, cloud, and endpoint security platforms, closing visibility gaps and strengthening detection coverage.
Automate Security Operations: Build automation and AI-driven workflows that streamline triage, investigation, enrichment, and response, reducing manual effort and improving operational efficiency.
Threat Hunting & Research: Proactively hunt for threats, leverage threat intelligence, and identify emerging attack techniques relevant to modern enterprise environments.
Own Security Operations: Serve as the technical owner for Security Operations within Product Security, driving strategy, setting best practices, and continuously improving detection and response capabilities.
Partner Across Engineering: Collaborate closely with Engineering, IT, Infrastructure, and Compliance teams to embed security into new services, infrastructure changes, FedRAMP initiatives, and customer-facing security requirements.
Communicate During Incidents: Provide clear, timely communication throughout incident response, keeping technical teams, leadership, and stakeholders aligned on impact, progress, risks, and next steps.

As a Security Operations & Automation, you'll be the hands-on architect of how Port detects, investigates, and responds to threats - built around AI agents and deep tooling integrations, not manual triage. You'll own incident response across corporate systems, workstations, and identity, unify alerts from every source - including cloud-originated signals that need a response - into a single SOAR/XDR fabric, and deploy AI agents to handle first-line investigation and response.

You'll work closely with IT and the Cloud Security team - taking the lead on investigation, triage, and response while they own the underlying cloud and SDLC architecture - and turn complex security signals into structured, AI-assisted, largely autonomous outcomes - fighting fire with fire.



Responsibilities

Architect and own Port's AI-driven detection and response stack, integrating SIEM, XDR, SOAR, EDR, and IAM into a single automated fabric rather than siloed tools.
Deploy and tune AI agents to handle first-line alert triage, enrichment, and investigation, with humans engaged only for true edge cases - manual L1 triage is the exception, not the default.
Build SOAR playbooks and integrations across the security and IT toolchain (endpoint, identity, ticketing, chat) so detection, enrichment, and remediation run automatically end to end - regardless of which system or platform an alert originates from.
Own the alert pipeline as a whole: unify signals from EDR, IAM, and other sources - including cloud and SaaS alerts surfaced by the Cloud Security team - into one triage and response workflow, so nothing falls through the cracks between tools.
Evaluate and integrate best-of-breed, AI-native security tools - SIEM, XDR, SOAR, EDR, email security, AI guardrails, ZTNA, and others - wiring each into the unified detection and response fabric rather than running them as siloed point solutions. Hands-on tool integration (APIs, connectors, log and telemetry ingestion) is a core skill for this role, not an occasional task.
Drive vulnerability and patch management across corporate systems and endpoints, automating prioritization and remediation workflows and coordinating with IT against strict SLAs.
Build and tune detection rules specific to Port's environment, treating detection as code and feeding AI-driven correlation across the XDR layer.
Maintain security dashboards (MTTD/MTTR, automation rate, % of alerts resolved without human touch) and report on how automation is cutting noise and response time.

We are seeking an Incident Response Engineer to join the IR team. This technical role focuses on active investigation, threat mitigation, and the continuous improvement of the security organizations posture through detection engineering and automation development.

The successful candidate will be responsible for the full lifecycle of security incidents, from initial triage to recovery. Beyond reactive response, this role involves tuning SIEM correlation rules and developing SOAR workflows to increase operational efficiency.

What Youll Be Doing
Incident Management: Execute the IR lifecycle (Triage, Containment, Eradication, Recovery) for complex security events.
Technical Investigation: Perform root cause analysis and forensic examination across Windows, Mac, and Linux environments.
Detection & Tuning: Collaborate with the IR team to create, test, and tune SIEM rules and dashboards to reduce false positives and improve visibility.
Automation Engineering: Build and refine SOAR playbooks and automated response actions to streamline repetitive investigation tasks.
Cloud Security: Monitor and mitigate cloud-native threats across Azure, AWS, and GCP environments.

Were looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.
As a Senior Hyperautomation Engineer - Wayfinder MDR, you will be tasked with designing, building, and operating the automation layer that powers Wayfinder MDR. Join our Wayfinder MDR organization, an elite Managed Detection & Response service protecting some of the worlds largest and most complex environments. You will work closely with Threat Service Engineers (TSEs), SOC analysts, Threat Hunters, and R&D teams to transform manual SOC processes into scalable, reliable, and efficient automation workflows. This role focuses on engineering and automation, not alert triage. You will help shape how MDR operates at scale by reducing manual workload, improving signal-to-noise ratio, and enabling faster and more consistent threat detection and response.
What Will You Do?
Primary responsibilities include:
Design, develop, and maintain hyperautomation workflows that support alert triage, enrichment, investigation, and response.
Convert SOC playbooks, investigation logic, and threat-hunting processes into automated, production-grade workflows.
Proactively identify repetitive or high-volume SOC tasks and implement automation to improve efficiency and consistency.
Build and maintain integrations with internal platforms and third-party security tools using APIs, webhooks, and event-driven mechanisms.
Collaborate closely with Threat Service Engineers (TSEs) and SOC teams to fine-tune existing detections and automation logic.
Improve and optimize MDR operational processes to ensure fast response times and effective threat mitigation.
Own automation workflows end-to-end, including design, deployment, monitoring, troubleshooting, and continuous improvement.
Create and maintain automation playbooks, templates, and best practices to support incident response at scale.
Work closely with R&D and product teams to provide operational feedback and help shape future detection and response capabilities.

we are looking for a SecOps Detection & Response.
As a Security Operations Analyst, Detection & Response, you will help protect Aidocs cloud environments, products, corporate systems, and sensitive healthcare data by investigating SIEM alerts, supporting incident response, and improving the quality of security monitoring.
This is a hands-on security operations role for someone who can analyze security signals, understand real risk, communicate clearly, and help the organization respond quickly and effectively to security events.
You will work closely with real production environments, where accurate investigation, clear documentation, and practical escalation are critical to protecting sensitive healthcare data, customer trust, and the reliability of Aidocs clinical AI platform.
Responsibilities:
Own the end-to-end investigation of SIEM alerts across cloud, product, identity, endpoint, and SaaS environments: analyze the relevant evidence, separate false positives from real threats, and prioritize cases based on risk and impact.
Escalate high-risk findings with a clear summary of what happened, what is affected, why it matters, and what actions are required.
Support incident response by collecting evidence, assisting with containment, tracking remediation, and maintaining clear investigation records for internal reviews, compliance needs, and post-incident learning.
Improve SIEM rules, dashboards, alert logic, playbooks, telemetry coverage, and detection quality to reduce noise and strengthen security monitoring.
Work with Security, IT, DevOps, R&D, Product Security, and Compliance teams to resolve issues and improve security operations.

We are looking for a skilled Security Automation Engineer to join our SOC Automation team and play a key role in building and scaling automation across Security Operations. This is a hands-on role - you will design, develop, and integrate automation solutions across SIEM, EDR, and other security platforms, contributing to our SOAR capabilities from the ground up.

You will work in a technologically rich environment, integrating with a wide range of security and infrastructure systems across the network - a unique opportunity to build automation at scale in a greenfield setting, with real influence over the architecture and tooling decisions.

We are especially interested in candidates who are curious about leveraging AI and intelligent agents to help evolve next-generation automation and response workflows - and who want to be a driving voice in how we apply those technologies.

Your responsibilities will include:

Automation development

Design and develop automation workflows for incident response and SOC operations
Identify and eliminate manual processes through scalable automation
Build reusable components and maintainable automation patterns
Engineering & integration

Develop integrations using REST APIs, webhooks, and event-driven architectures
Write high-quality, maintainable Python for automation and orchestration
Implement data parsing, enrichment, and transformation across multiple systems
SOAR & platform buildout

Lead or actively contribute to the evaluation, selection, and implementation of SOAR/automation platforms
Design the automation architecture and integration strategy for the team
Build automation capabilities in a greenfield environment - your decisions will shape the foundation
SOC collaboration

Work closely with SOC analysts and incident responders to translate operational needs into automation solutions
Improve end-to-end detection and response workflows through close partnership with the team
AI & innovation

Actively build and evaluate AI/LLM and agent-based workflows applied to security automation
Prototype AI-assisted enrichment, triage, and response solutions and drive them toward production

We are looking for a SecOps Engineer to join our Security Operations team. In this role, you will help defend the organization end-to-end, from IT security to endpoint and cloud security - while performing third-party and internal security reviews, handling incident response, conducting threat hunting, and supporting GenAI security work.
Responsibilities
Design, operate, and improve security infrastructure by maintaining core controls, hardening systems, and leading cloud security efforts to address misconfigurations, vulnerabilities, and identity risks
Monitor, investigate, and remediate security alerts and threats by performing DFIR, analyzing attack vectors, proactively hunting adversary activity, and leading incident response
Perform security reviews of third-party vendors, SaaS platforms, and internal applications, assessing architectures, data flows, integrations, and risk exposure
Defend the organization end-to-end across endpoints, identities, applications, and cloud by operating and advancing SecOps controls (SIEM/EDR/CSPM), building automations, enforcing best practices, and partnering cross-functionally to drive security outcomes.

Great IT and security work means nobody notices the bugs because you already squashed them. From cloud engineers to IT operations managers, our team combines technical expertise with a deep respect for what's at stake. So if you're proactive and precise under pressure, the Fiverr Cyber, IT and MIS team might be the right place for you. Join our Cloud Engineering department as a SecOps Engineer and play a critical role in safeguarding our complex, multi-cloud environment. You'll be essential in maintaining our incident response and security Service Level Agreements (SLAs), preventing team burnout, and ensuring our security posture remains robust in a dynamic, fast-paced setting.

What am I going to do?:

* Champion the monitoring and initial triage of security alerts, meticulously investigating potential threats to uphold our SLA targets.
* Own and execute essential daily SecOps tasks, ensuring seamless operations and preventing critical backlogs.
* Serve as a key security liaison for Cloud Engineering peers, facilitating project momentum without overburdening senior staff.
* Configure, fine-tune, and optimize a suite of security tools, maximizing visibility and effectiveness across our cloud infrastructure.
* Dive deep into security events and alerts, identifying vulnerabilities and prioritizing remediation actions with precision.
* Develop and implement automation for routine security operations, including vulnerability scanning, incident triage, and configuration management, to enhance efficiency.

Equal opportunities:
At Fiverr, we're not about checklists. If you don't meet 100% of the requirements for this role but still feel passionate about the position and think you have the right skills and qualifications to excel at it, we want to hear from you. At Fiverr, we prioritize diversity. We celebrate difference and embed it into every aspect of our workplace and product, as well as our community. Fiverr is proud and committed to providing equal opportunity employment to all individuals regardless of race, color, religion, sex, sexual orientation, citizenship, national origin, disability, Veteran status, or any other characteristic protected by law. In addition, Fiverr will provide accommodation to individuals with disabilities or a special need.

Required SecOps Engineer
Great IT and security work means nobody notices the bugs because you already squashed them. From cloud engineers to IT operations managers, our team combines technical expertise with a deep respect for what's at stake. So if you're proactive and precise under pressure, the Cyber, IT and MIS team might be the right place for you.
Join our Cloud Engineering department as a SecOps Engineer and play a critical role in safeguarding our complex, multi-cloud environment. You'll be essential in maintaining our incident response and security Service Level Agreements (SLAs), preventing team burnout, and ensuring our security posture remains robust in a dynamic, fast-paced setting.
What am I going to do?
Champion the monitoring and initial triage of security alerts, meticulously investigating potential threats to uphold our SLA targets.
Own and execute essential daily SecOps tasks, ensuring seamless operations and preventing critical backlogs.
Serve as a key security liaison for Cloud Engineering peers, facilitating project momentum without overburdening senior staff.
Configure, fine-tune, and optimize a suite of security tools, maximizing visibility and effectiveness across our cloud infrastructure.
Dive deep into security events and alerts, identifying vulnerabilities and prioritizing remediation actions with precision.
Develop and implement automation for routine security operations, including vulnerability scanning, incident triage, and configuration management, to enhance efficiency.

As a Cloud Security Lead (Cloud Security Architecture & Hardening) , you will design, implement, and enhance the security of our mission-critical cloud infrastructure and the Enterprise Browser by establishing robust security architectures, implementing proactive hardening controls, and driving continuous operational excellence. You will play a critical role in safeguarding our cloud environment, shaping the foundational security posture through precision, innovation, and design foresight.

Key Responsibilities

Cloud Security Architecture & Hardening: Design and enforce security baselines, configurations, and reference architectures across our multi-cloud footprint (AWS/GCP/Azure). Evaluate new cloud services and features for security implications and create hardened deployment standards for IaaS, PaaS, and serverless components.
Security Engineering & Automation: Develop and deploy security-as-code solutions, integrating security controls directly into CI/CD pipelines and leveraging Infrastructure-as-Code (IaC) tools to ensure continuous configuration integrity and compliance. Develop custom automation for detection, alerting, and triage workflows, leveraging cloud SDKs and APIs.
Cloud Security Monitoring & Observability: Design, implement, and maintain cloud-native security monitoring solutions (e.g., utilizing services like CloudTrail, GuardDuty, Security Command Center) to ensure comprehensive visibility across the cloud control plane and data plane.
Incident Triage & Response: Support the security team in investigating and responding to critical security events and vulnerabilities, creating runbooks, and contributing to post-incident remediation and architectural improvements.
Security Enablement & Awareness: Collaborate with product, engineering, and IT teams to improve security awareness, deliver training, and drive adoption of security best practices across , specifically for IaaS, PaaS, and secure DevOps practices.