דרושים » אבטחת מידע וסייבר » Sr MSIAM SOC Engineer (Unit 42)

As a Senior SOC Engineer within Unit 42 at Palo Alto Networks, you will drive the creation, validation, and optimization of custom detection rules and automated playbooks across our global customer base. Acting as a trusted advisor, you will collaborate closely with clients to maximize their security posture using Cortex XSIAM and Unit 42 expertise. This highly analytical role leverages your deep understanding of detection lifecycles, proactive automation, and threat intelligence to secure enterprise environments. You will architect end-to-end security lifecycles that seamlessly connect data ingestion with high-fidelity detection engineering.
Key Responsibilities
Own the full lifecycle of custom detections and response automations, deploying them as high-fidelity Cortex XSIAM correlation rules and playbooks through a rigorous engineering process of development, testing, staging, and soft implementation.
Drive the continuous refinement of correlation rules to ensure strict standards for performance, accuracy, and operational relevance.
Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable, robust detection logic.
Champion proactive automation by engineering sophisticated playbooks to resolve emerging security challenges and optimize operational workflows ahead of demand.
Architect the end-to-end security lifecycle within Cortex XSIAM, seamlessly connecting data ingestion, high-fidelity detection engineering, and sophisticated response automation.

Required Senior Security Engineer
As a Senior Enterprise Security Engineer, you will be a foundational architect of our security posture, directly safeguarding our corporate infrastructure, sensitive financial data, and global user base. This is a highly hands-on, configuration-driven role that requires working directly with systems that power our security program in a modern, cloud-native environment.
Your work will be critical in ensuring we become globally recognized for secure, unparalleled corporate travel and expense management.
What Youll Do:
Vulnerability Management & Exposure Reduction: Architect, manage, and scale the end-to-end vulnerability management program. Oversee continuous asset discovery, vulnerability scanning, threat exposure assessment, and risk-based prioritization (CVSS, EPSS, threat intelligence). Partner closely with infrastructure, engineering, and IT teams to establish SLAs, streamline patch management workflows, and validate effective remediation.
Security Incident Response & On-Call Rotation: Participate in the security engineering on-call rotation. Serve as a responder responsible for identifying, scoping, triaging, managing, and mitigating security incidents, followed by leading thorough post-incident reviews and root-cause analyses.
Detection & Automation Optimization: Help improve and maintain our existing detection pipeline by providing feedback on alert quality, reviewing current monitoring coverage, and performing direct tuning in SIEM platforms to reduce noise and increase signal fidelity. Evaluate existing SOAR playbooks and workflows, offering recommendations and performing targeted updates to streamline response processes.
Identity Governance & Access Control: Define and enforce strong IAM principles (e.g., Least Privilege, Zero Trust) and contribute to identity governance platforms to ensure secure authentication, authorization, and access across the enterprise.
Email Security: Strengthen email security by managing alerts and workflows in platforms like Material Security, reviewing post-delivery threats, and improving automated response to suspicious messages and mailbox activity.

Required Principal / Sr. Principal Security Research - Advanced Cyber Research (Cortex)
We are seeking a visionary and highly technical Principal / Sr. Principal Security Researcher to join our security research team. In this role, you will be at the forefront of innovating automated defense systems to rapidly protect platform customers against advanced cyber threats at an unprecedented scale. This position offers a unique opportunity to blend deep traditional cybersecurity expertise - including OS internals, reverse engineering, and advanced detection engineering with cutting-edge AI technologies like LLMs, SLMs, and agentic workflows.
You will spearhead the creation of innovative prevention solutions, leveraging massive streams of agent telemetry to design AI-driven logic that neutralizes threats before they execute. As a key technical leader, you will partner closely with top-tier data scientists and product engineers to translate cutting-edge security research into production-grade capabilities, ensuring we stay ahead of the evolving threat landscape.
Key Responsibilities:
Develop Automated Defense Systems:Create, engineer, and deploy automated solutions for the prevention and detection of advanced cyber threats, analyzing complex data to rapidly protect platform customers at scale.
Innovate with AI:Partner closely with data scientists to leverage LLMs, SLMs & deeplearning techniques to fuel these advanced prevention solutions and automated defense capabilities.
Research, develop, and continuously improve the Agentix solution. Drive the development of next-generation security content by designing and implementing specialized AI agents to automate security operations and workflows.
Drive Security Innovations:Spearhead new research initiatives from the ground up. Act as the primary driver across key stakeholders, leading top-tier data scientists and engineers to ensure the successful delivery of enterprise-grade security capabilities.

Principal Security Researcher (Cortex - AgentiX)
Job Summary:
As a Principal Security Researcher , you will act as an architect for the Autonomous SOC, focusing directly on Cortex AgentiX. You will design and build intelligent, automated investigation and remediation agents that empower thousands of customers to secure their environments at scale.
We are looking for a practitioner who combines deep hands-on expertise investigating threats and protecting organizations with a pragmatic approach to solving complex security challenges.
Key Responsibilities:
Develop in-product specialized agents to accelerate detection, respond to real-time threats, prioritize, and mitigate risks.
Establish guardrails, continuous evaluation metrics, and deterministic controls for agentic AI, ensuring complex multi-step plans execute reliably.
Drive the complete product development lifecycle, encompassing definition, design, implementation, and testing phases.
Partner cross-functionally with product management, engineering, and research teams.

You will be the only SOC analyst based in Israel, while the rest of the analyst team operates from the Philippines. You will act as the SOCs local anchor - the on-site technical counterpart for the Israel-based Cyber Security, IT, Operations, and R&D teams, and the escalation and knowledge bridge between them and the offshore shifts. The role calls for ownership, independence, and the appetite to build and improve, not only to operate.

Responsibilities

Monitoring and Detection: Continuously monitor SIEM, endpoint protection (EDR), IPS, mail security, CASB, cloud, and identity security solutions to identify potential threats.
Incident Response: Serve as one of the first levels of escalation for security incidents - investigate, contain, and drive resolution before escalating to the senior SecOps members, in accordance with defined procedures and SLAs.
Incident Coordination: Lead coordination of major incidents until ownership is transferred to the relevant SecOps, IT, Operations, or R&D team; ensure clear communication, escalation, and tracking of action items.
Threat Analysis: Analyze logs, network traffic, endpoint telemetry, and native (in-tool) alerts to determine root cause, scope, impact, and remediation steps.
SIEM and Detection Engineering: Own day-to-day operation of the SIEM - data onboarding and ingest pipelines, field mapping and data quality, dashboards and platform health - and write, tune, and maintain detection rules while measuring their effectiveness.
Exclusion and Exception Management: Own the exclusion and exception lifecycle across the security stack: review requests, assess risk, apply scoped, time-bound exclusions, and revalidate them periodically.
Automation and AI-Assisted Operations: Build and maintain automations across the SOC toolchain (enrichment, containment, ticketing, reporting), and design, implement, and validate AI/LLM-based workflows for alert triage, investigation support, and documentation - including guardrails and quality control of AI output.
Investigation Documentation: Create and maintain detailed incident tickets, including investigation audit trail, action items, and timelines.
Technical Leadership: Act as the senior operational reference for the analyst team: help prioritize workload, assure investigation quality, maintain consistent handling of incidents, escalations, and shift handovers, and mentor analysts on tooling and methodology.
Collaboration: Work closely with the Cyber Security team, IT, Operations, and R&D locally, and with the offshore SOC team across time zones.
Continuous Improvement: Drive improvements to detection logic, automation, operational runbooks, and shift handover documentation based on lessons learned from incidents.
Compliance and Reporting: Support reporting for compliance audits, management reviews, and threat intelligence updates.

Required Senior/ Principal Security Researcher - Cloud & Kubernetes (Cortex)
Job Summary:
If you are an innovator at heart and passionate about redefining how organizations secure modern environments end-to-end, we're looking for you. This is an opportunity to join an exceptional group of researchers working on a startup-level product within the largest security company, helping revolutionize how organizations protect their Kubernetes and hybrid cloud environments.
Key Responsibilities:
Contribute to a team of talented security researchers focused on defending organizations as they transition from on-premises data centers to modern cloud and Kubernetes infrastructure.
Drive the execution of research initiatives to uncover novel techniques for detecting and responding to sophisticated attacks targeting hybrid and cloud-native environments.
Define and prioritize detection use cases, relevant datasets, and innovative analytic approaches combining runtime visibility and posture management across diverse platforms.
Stay up to date with the latest attacker methodologies, APT campaigns, and TTPs to ensure our detection capabilities stay ahead of evolving threats in both legacy and cloud contexts.
Simulate real-world attacks and perform deep behavioral analysis to inform and validate detection content.
Collaborate across engineering, product management, and go-to-market teams to deliver impactful security solutions.
Share insights with the security community through blogs, conference talks, and publications.

Were looking for Principal Cloud Security Researcher with a strong security background to join our innovative Research team.

EDR protects the endpoint. our company protects everything else, anticipating and disrupting active attacks across the modern stack and stopping them before they reach the business.

our company is the leader in Zero-Impact Breach Prevention, delivered through Agentic Runtime Security for the modern infrastructure - cloud, SaaS, identity, and AI. By delivering the runtime detection and response that security teams already rely on for endpoints, extended to the infrastructure endpoint tools cant see, our company provides Zero-Impact Breach Prevention, in runtime.

The Role

We're looking for a Principal Cloud Security Researcher to serve as a senior technical leader within our Research team. This is a high-impact individual contributor role -- you won't manage people, but you'll shape the direction of our entire research function, mentor researchers, and act as a force multiplier across the organization.

You'll be the person who takes a vague threat signal and turns it into a detection strategy, a published finding, or a product capability. You'll operate as a trusted deputy to the research team lead, owning the most complex and ambiguous research challenges while raising the technical bar for the team.



What You'll Do

Drive Groundbreaking Research

Own and drive our most critical research initiatives end-to-end - from initial threat hypothesis through detection logic, product integration, and external publication.
Set the technical direction for cloud threat research across AWS, Azure, and GCP, identifying emerging attack surfaces and novel techniques before they become mainstream threats.
Investigate real-world cloud and SaaS security incidents, dissecting attacker tradecraft and extracting insights that evolve our detection capabilities.
Pioneer new forensic investigation techniques and detection methodologies for cloud-native and SaaS environments - pushing the state of the art, not just following it.
Be a Voice in the Community

Represent our company as a thought leader through high-quality research publications, conference presentations (BlackHat, DEF CON, RSA, fwd:cloudsec, and similar venues), and open-source contributions.
Build and maintain our reputation as a research-driven company that advances the field - not just a vendor with a blog.
Engage with the broader security research community, fostering relationships and collaborative knowledge-sharing.
Shape the Product

Bridge research and product - translate threat findings into actionable product requirements, working closely with engineering and product teams to ensure our CDR platform stays ahead of evolving threats.
Design and develop advanced detection algorithms that directly feed into our platform, closing the gap between research insight and customer protection.
Elevate the Team

Act as the team's go-to technical authority. When researchers hit a wall on complex cloud attack chains, IAM edge cases, or detection gaps - you're who they turn to.
Mentor and grow other researchers through research reviews, pair investigations, code reviews, and by setting quality standards and methodology best practices.
Influence technical decisions org-wide - contributing to architecture, tooling, and strategic research priorities.
Step in as the research team lead's deputy when needed - driving prioritization, representing research cross-functionally, and ensuring continuity.

Were growing and looking to hire a Senior Security Operations Engineer who embodies our core values: People First, Customer Obsession, Strive for Excellence, and Integrity.
About the Company:
A global leader in cyber-physical systems (CPS) protection, dedicated to securing the critical infrastructure that keeps the world running. Were a fast-growing, award-winning team where innovation meets purpose-and we want you to help us define the future of cybersecurity.
About the Role:
In this role, you will be a key architect and operator of our modern security posture, focusing heavily on Cloud Access Security Broker (CASB/SSE) architecture, next-generation Endpoint Detection & Response (EDR), and securing the deployment and usage of Artificial Intelligence (AI) and Large Language Models (LLMs) across the enterprise.
As threats evolve, we are proactively embedding AI-driven defense mechanisms while managing the unique threat vectors introduced by enterprise AI adoption. If you thrive at the intersection of data protection, cloud edge security, and cutting-edge automation, this position offers an exceptional opportunity to impact our global defense strategy.
Responsibilities
As a Senior Security Operations Engineer, your responsibilities will include:
Engineering level oversight and support of the operational security environment including endpoint security, cloud/SaaS security, email security, AI security, and network security.
Design, implement, and maintain security solutions for on-premises and cloud environments (e.g., AWS, Azure, GCP).
Architect, configure, and maintain Security Service Edge (SSE), including CASB, Next-Gen SWG, and ZTNA. Establish data loss prevention (DLP) profiles, threat protection policies, and granular access controls across multi-cloud and SaaS environments.
Assist in responses to internal and external compliance audits, penetration tests and vulnerability assessments.
Provide recommendations regarding direction of systems and applications to help secure access, data and assets.
Research and analyze Security Operations Center (SOC) related cyber threats , alerts, and vulnerabilities and ensure our systems are properly protected.
Conduct research on emerging products, services, protocols, and standards relative to the information security arena.
Work with IT Security product vendors and service providers, to evaluate potential security offerings, including product evaluations, pilots and proof of concept installations
Ability to understand and troubleshoot cyber security issues, network configurations, system configurations and upgrades, user authentication, etc..
Ability to work well with other technology areas to deploy security technologies.
Customer service-oriented
Strong work ethic and sense of urgency
Develop and maintain security architecture diagrams, documentation, and standards.

As a Security Researcher , you will play a key role in shaping the future of modern runtime and AI security. You will investigate how real-world attacks unfold across applications and cloud environments, and turn those insights into innovative, production-grade security capabilities.

This role is ideal for a deeply technical researcher who is driven to understand attacks at their core - not just identify surface-level indicators. You will research exploitation chains, runtime behavior, attacker techniques, and emerging AI attack patterns, then apply that knowledge to build protections that are precise, resilient, scalable, and grounded in how attacks actually work.

Specifically, you will:

Research real-world attack techniques targeting modern applications, cloud-native environments, and AI-driven systems.
Design, develop, validate, and deploy detection algorithms based on technical research, large-scale runtime telemetry, threat intelligence, and exploit PoCs.
Shape the strategy for detection data collection by defining the required telemetry, collection points, and data quality standards needed to support effective protection.
Drive research efforts end-to-end, from initial exploration and technical investigation to production-grade protection capabilities for active threats.
Work closely with engineering and product teams to turn research into practical security capabilities.

Required Senior Detection & Response Analyst
Job Summary
Join our brand new D&R team and help service our biggest customers, who trust us to offer a tailored service responding to high-severity threats across their enterprises. As a leading AI SOC platform covering the full SecOps lifecycle from triage to response, we blend deep security expertise with cutting-edge AI. We investigate every alert at forensic depth, disrupting the traditional MDR market and empowering security teams at companies like Nvidia, MGM Resorts, Salesforce, and Equifax. If you're excited to jump in, do high-impact work, and help shape how modern SOCs operate as we grow fast, we'd love to have you.
Responsibilities:
Investigate and resolve high-severity threats escalated by our AI SOC platform across major enterprise customers
Lead triage, containment, and remediation of live incidents, working directly with customer security teams
Write and maintain playbooks, detection content, and escalation procedures under the direction of the Head of Detection & Response
Communicate findings clearly to customer SOC teams and stakeholders, translating technical detail into risk and recommended actions
Feed real-world incident learnings back to Product and Research to improve detection logic and the platform itself
Use AI-native tooling and automation to scale your own output, and help shape how the team works with it
Participate in an on-call rotation for critical customer incidents.