דרושים » אבטחת מידע וסייבר » SOC Analyst

we are looking for a MXDR Analyst to join the team of cybersecurity analysts monitoring services 24/7. The role includes development of detection analyses, triage of alerts, investigation of security incidents, proactive threat hunting and enhancement of sensors and overall visibility status.
The suitable candidate should be a team player with previous experience in SOC, SecOps or security monitoring, independent, and with a can-do attitude.
Responsibilities:
Working across all areas of Sygnias SOC, including continuous monitoring and analysis, threat hunting, security compliance, security event auditing and analysis, rule development and tuning, and forensics.
Solving security incidents in accordance with defined service level agreements and objectives.
Prioritizing and differentiating between potential incidents and false alarms.
Addressing clients enquiries via phone, email, and live chat.
Working side-by-side with customers, providing insightful incident reports.
Working closely with peers and higher-tier analysts to ensure that your analysis work meets quality standards.
Identifying opportunities for improvement and automation within the MXDR Operation Lead, and leading efforts to operationalize ideas.
Identifying and offering solutions to gaps in current capabilities, visibility, and security posture.
Correlating information from disparate sources to develop novel detection methods.

The Services Operations Center (SOC) is a team within Customer Success whose function is to monitor the quality of service of our company clusters deployed in the field, and take the necessary actions in the case of service degradation or outage. The person that works in a SOC is a SOC Operator. This person will be looking at a dashboard of monitored items, and when green lights turn red, they will click on the red light, read a runbook, and endeavor to resolve the issue. If they can fix the problem in 30 mins, they will. If they can not fix the problem, they will declare an incident and page in Support who will begin troubleshooting, and begin keeping a timeline of events. If Support can't fix the problem, the SOC Operator will page in R&D. The SOC Operator will 'run' the incident until the issue is resolved. Once resolution occurs, the SOC operator close out ticket, and publish a Preliminary Findings Report in the ticket. All the while, the SOC Operator will provide a play-by-play in the internal slack channel to keep everyone aware of what's happening.
Job Description
Job Summary: As a SOC Operator, you will be responsible for monitoring and maintaining the health and performance of our fleet of installed clusters. You will work in a 24/7 operations environment, ensuring the availability, reliability, and security of services. This role involves real-time monitoring, incident detection, incident management, incident resolution, and clear written and verbal communication with other teams and stakeholders.
Responsibilities:
Monitor clusters using internal monitoring tools to detect and troubleshoot issues promptly.
Respond to alerts and incidents in a timely manner, following standard operating procedures (SOPs) and escalation processes.
Perform initial investigation and diagnosis of problems, escalating complex issues to support or R&D.
Document incidents, including their details, troubleshooting steps, and resolutions in the incident tracking system.
Collaborate with other teams, including Support, R&D, Account teams, and customers to ensure effective incident resolution and communication.
Conduct routine checks and audits to identify potential problems or vulnerabilities.
Assist with the implementation of changes and updates to the infrastructure as directed by team leads.
Participate in shift-based work schedules, including nights, weekends, and holidays, to provide 24/7 coverage in the SOC.
Maintain up-to-date knowledge of storage technologies, industry trends, and best practices.
Adhere to security protocols and ensure the confidentiality, integrity, and availability of network and system data.
Contribute to the development and improvement of SOC processes and procedures.
Provide excellent customer service to internal and external stakeholders during incident resolution and communication.
High school diploma or equivalent; a degree or certification in information technology or a related field is a plus.
Proven experience as a SOC Operator or in a similar network monitoring role is preferred.
Strong understanding of networking concepts, protocols, and technologies (TCP/IP, SNMP, DHCP, DNS, etc.).
Ability to work independently and collaboratively in a team-based environment.
Excellent problem-solving and analytical skills, with the ability to multitask effectively.
Good communication skills, both written and verbal, to interact with technical and non-technical stakeholders.
Willingness to work in a 24/7 shift-based environment, including nights, weekends, and holidays.
Detail-oriented and committed to maintaining accurate documentation.
Demonstrated commitment to continuous learning and self-improvement.

Required Senior Detection & Response Analyst
Job Summary
Join our brand new D&R team and help service our biggest customers, who trust us to offer a tailored service responding to high-severity threats across their enterprises. As a leading AI SOC platform covering the full SecOps lifecycle from triage to response, we blend deep security expertise with cutting-edge AI. We investigate every alert at forensic depth, disrupting the traditional MDR market and empowering security teams at companies like Nvidia, MGM Resorts, Salesforce, and Equifax. If you're excited to jump in, do high-impact work, and help shape how modern SOCs operate as we grow fast, we'd love to have you.
Responsibilities:
Investigate and resolve high-severity threats escalated by our AI SOC platform across major enterprise customers
Lead triage, containment, and remediation of live incidents, working directly with customer security teams
Write and maintain playbooks, detection content, and escalation procedures under the direction of the Head of Detection & Response
Communicate findings clearly to customer SOC teams and stakeholders, translating technical detail into risk and recommended actions
Feed real-world incident learnings back to Product and Research to improve detection logic and the platform itself
Use AI-native tooling and automation to scale your own output, and help shape how the team works with it
Participate in an on-call rotation for critical customer incidents.

Were looking for Principal Cloud Security Researcher with a strong security background to join our innovative Research team.

EDR protects the endpoint. our company protects everything else, anticipating and disrupting active attacks across the modern stack and stopping them before they reach the business.

our company is the leader in Zero-Impact Breach Prevention, delivered through Agentic Runtime Security for the modern infrastructure - cloud, SaaS, identity, and AI. By delivering the runtime detection and response that security teams already rely on for endpoints, extended to the infrastructure endpoint tools cant see, our company provides Zero-Impact Breach Prevention, in runtime.

The Role

We're looking for a Principal Cloud Security Researcher to serve as a senior technical leader within our Research team. This is a high-impact individual contributor role -- you won't manage people, but you'll shape the direction of our entire research function, mentor researchers, and act as a force multiplier across the organization.

You'll be the person who takes a vague threat signal and turns it into a detection strategy, a published finding, or a product capability. You'll operate as a trusted deputy to the research team lead, owning the most complex and ambiguous research challenges while raising the technical bar for the team.



What You'll Do

Drive Groundbreaking Research

Own and drive our most critical research initiatives end-to-end - from initial threat hypothesis through detection logic, product integration, and external publication.
Set the technical direction for cloud threat research across AWS, Azure, and GCP, identifying emerging attack surfaces and novel techniques before they become mainstream threats.
Investigate real-world cloud and SaaS security incidents, dissecting attacker tradecraft and extracting insights that evolve our detection capabilities.
Pioneer new forensic investigation techniques and detection methodologies for cloud-native and SaaS environments - pushing the state of the art, not just following it.
Be a Voice in the Community

Represent our company as a thought leader through high-quality research publications, conference presentations (BlackHat, DEF CON, RSA, fwd:cloudsec, and similar venues), and open-source contributions.
Build and maintain our reputation as a research-driven company that advances the field - not just a vendor with a blog.
Engage with the broader security research community, fostering relationships and collaborative knowledge-sharing.
Shape the Product

Bridge research and product - translate threat findings into actionable product requirements, working closely with engineering and product teams to ensure our CDR platform stays ahead of evolving threats.
Design and develop advanced detection algorithms that directly feed into our platform, closing the gap between research insight and customer protection.
Elevate the Team

Act as the team's go-to technical authority. When researchers hit a wall on complex cloud attack chains, IAM edge cases, or detection gaps - you're who they turn to.
Mentor and grow other researchers through research reviews, pair investigations, code reviews, and by setting quality standards and methodology best practices.
Influence technical decisions org-wide - contributing to architecture, tooling, and strategic research priorities.
Step in as the research team lead's deputy when needed - driving prioritization, representing research cross-functionally, and ensuring continuity.

we are looking for a hands-on Senior Security Operations Engineer who wants to do more than monitor alerts and hand off tickets. In this role, you will have the rare opportunity to identify security problems, understand their root causes, and work directly with the teams responsible for fixing them.
You will strengthen threat detection, incident response, vulnerability management, and cloud security operations through a combination of investigation, engineering, and automation. You will design and tune detections, lead investigations and response efforts, prioritize and route vulnerabilities and CSPM/CWP findings, improve security telemetry, and build capabilities that reduce manual effort and help the organization respond faster.
This is an engineering-focused SecOps role- not a traditional alert-monitoring position. You will be expected to turn operational insights into durable improvements: better detections, stronger controls, cleaner telemetry, streamlined workflows, and measurable risk reduction. You will work closely with Cloud Security, Identity and IT, AppSec, Product Engineering, Platform Engineering, GRC, and service owners to secure corporate and cloud environments.
You will also help shape how secures AI-enabled tools, agents, and automation as they become part of the way we work. If you enjoy moving from signal to solution-and want the autonomy and cross-functional access to make security improvements stick-this role is built for you.

Act as a Customer Security Advisor, conducting threat-hunting activities and performing security assessments on customer networks. Effectively communicate findings, recommendations for remediation, and mitigation strategies to customers
Serve as an escalation point for the SOC analysts, assisting in the investigation, analysis, and response to security incidents
Develop cyber kill-chain indicators of an attack and hunting heuristics to enhance the ongoing threat-hunting process
Enhance the product accuracy and its capacity to detect emerging threats within the dynamic security landscape

We're looking for a Security Operations (SecOps) specialist to take ownership of our security infrastructure and operations as we scale. In this hands-on, high-impact role, youll play a crucial role in managing the infrastructure, services and service providers that help keep secure from outside attacks and insider threats, along with managing our information compliance programs.
Responsibilities:
Support and lead our security programs, both internal and with 3rd party vendors.
Lead incident response simulations and continuous vulnerability remediation efforts, optimizing our observability and alerting frameworks.
Support the design and maintenance of resilient, scalable cloud infrastructure, ensuring security is baked into the foundation.
Work closely with company leadership to ensure adoption of security best practices.
Work closely with R&D teams to help them shift security testing left into the early phases of development.
Monitor, detect, and respond to security alerts and infrastructure anomalies, optimizing our logging, tracing, and alerting frameworks.
Conduct regular reviews of security tools and infrastructure such as endpoint security, malware detection, firewall logs, and the like.
Collaborate with our CISO to implement and automate controls supporting fintech/insurtech compliance and data privacy standards (PII protection, SOC2).

We seek a dedicated and proactive Senior SecOps Engineer to join our InfoSec team and take ownership of all security-related tasks across the organization. In this role, you will be key in aligning security goals with infrastructure, R&D and IT requirements. You will be responsible for integrating security into our CI/CD pipelines, managing cloud infrastructure security, ensuring compliance with security standards, and protecting our infrastructure from vulnerabilities.
A day in the life and how youll make an impact:
Implement and manage security tools such as static code analysis, cloud posture monitoring, and penetration testing tools.
Embed security into the DevOps lifecycle, including CI/CD pipelines, IaC (Infrastructure as Code), and software development workflows.
Design and enforce security policies for cloud architecture, ensuring secure configurations and monitoring.
Lead incident response activities, vulnerability management, and forensic investigations to mitigate threats.
Drive compliance efforts (ISO 27001, SOC 2, GDPR, etc.) and audit readiness for the organization.
Work closely with stakeholders (CISO, COO, System Architects, DevOps, IT, Finance, HR, etc) to identify requirements and prioritize security needs.
Continuously monitor systems and infrastructure for vulnerabilities, intrusions, and misconfiguration.
Perform or manage penetration testing initiatives to identify security weaknesses.

Required Security Analyst
About the Role:
An industry leader heading into an exciting phase of growth. In this role, you will play an integral part in shaping a new and innovative SaaS product through deep data exploration, detection engineering, core KPI tracking, and actionable insights.
If you are a talented Security Data Analyst passionate about elevating trust, optimizing product performance, and leveraging next-gen technologies to protect customers, we want you on our team!
What youll do:
Build & Fine-Tune Detections: Design, build, and optimize detection rules and risk models to identify emerging fraud vectors while fine-tuning alert thresholds to minimize false positives.
Drive Product & Threat Analytics: Perform Exploratory Data Analysis (EDA), track core product/risk KPIs, and deliver data-driven insights that directly influence product strategy.
Escalation & Optimization: Act as an analytical escalation point for high-stakes enterprise client investigations, providing tailormade analytics to improve detection performance.
Actionable Visualizations: Translate complex data trends into clear dashboards and executive-ready reports that drive action across internal and external stakeholders.
AI & Automation Vision: Configure and deploy AI Agents & Skills within analytical workflows to serve as a key productivity multiplier for the team.
Cross-Functional Collaboration: Partner closely with Product and Analytics teams to support new feature rollouts and strategic decision-making.

As a Senior SOC Engineer within Unit 42 at Palo Alto Networks, you will drive the creation, validation, and optimization of custom detection rules and automated playbooks across our global customer base. Acting as a trusted advisor, you will collaborate closely with clients to maximize their security posture using Cortex XSIAM and Unit 42 expertise. This highly analytical role leverages your deep understanding of detection lifecycles, proactive automation, and threat intelligence to secure enterprise environments. You will architect end-to-end security lifecycles that seamlessly connect data ingestion with high-fidelity detection engineering.
Key Responsibilities
Own the full lifecycle of custom detections and response automations, deploying them as high-fidelity Cortex XSIAM correlation rules and playbooks through a rigorous engineering process of development, testing, staging, and soft implementation.
Drive the continuous refinement of correlation rules to ensure strict standards for performance, accuracy, and operational relevance.
Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable, robust detection logic.
Champion proactive automation by engineering sophisticated playbooks to resolve emerging security challenges and optimize operational workflows ahead of demand.
Architect the end-to-end security lifecycle within Cortex XSIAM, seamlessly connecting data ingestion, high-fidelity detection engineering, and sophisticated response automation.