דרושים » אבטחת מידע וסייבר » חוקר /ת DFIR - Incident Response Malware Analysis

Requirements:
7+ years of hands-on incident response and digital forensics, including technical leadership of large-scale, high-impact incidents (ransomware, nation-state / advanced threat actors, cloud intrusions, identity compromise).
Experience building or leading IR teams and capabilities in cloud or infrastructure-heavy environments, which are highly regulated (SOC 2, ISO 27001, GDPR/NIS2).
Technical Expertise

Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability.
Strong cloud-native platform security: containers and Kubernetes, CI/CD, secrets management, cloud control planes, and IAM attack paths.
Fluency in attacker TTPs (MITRE ATT&CK, including the Cloud and Containers matrices), and hands-on experience with EDR, SIEM, and forensic tooling (e.g., Velociraptor, Volatility, X-Ways/EnCase).
Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions.

Requirements:
Minimum Qualifications
6+ years of experience in security or threat research in which you conducted deep research with actionable conclusions and impacts.
Intimate knowledge of OS internals (Windows/Linux/MacOS) and networking.
Familiarity with cloud services, Kubernetes, cloud environment architecture, and the major cloud providers (AWS, GCP, Azure).
Proficiency in Python for tool development and automation.
Experience delivering security detections in customer-facing product(s).
The ability to learn independently, to be self-driven and goal-oriented.
Preferred Qualifications
Knowledge of Go, Rust, or C/C++.
Hands-on experience with malware analysis/reverse engineering/vulnerability research.
Familiarity with notable threat actors and threat intelligence analysis.
IR/red-team/threat-hunting experience.
Experience leveraging AI to supercharge research and detection workflows.
Deep knowledge of modern threat classes (Supply Chain, CI/CD, or threats targeting AI infrastructure and agentic frameworks).
Excellent communication and teamwork skills.

Requirements:
Extensive hands-on APT hunting, intrusion investigation, and digital forensics.
Deep understanding of APT tradecraft - stealth, persistence, credential abuse, defense evasion, living-off-the-land, custom tooling, supply-chain compromise, and command-and-control.
Broad forensic expertise across operating systems, cloud platforms, network and edge infrastructure, and memory, using industry-standard forensic and hunting tools.
Telemetry analysis across security platforms (EDR, SIEM, network, and identity systems) and the ability to build detection and hunting logic.
Strong development skills in Python (and ideally another language such as Go, C/C++, or PowerShell) to build tooling, automations, and analysis pipelines.
Strong communication for technical and executive audiences, including conference-grade presentations.
Represents the organization publicly, delivering talks, workshops, and research at top-tier cybersecurity and forensics conferences.
Nice to Have
Malware analysis and reverse engineering.
Experience with enterprise EDR/XDR and SIEM platforms.
Container, SaaS, and hybrid-cloud investigation experience.
Threat-intel collaboration; published research or prior conference talks.

Requirements:
2+ years of experience in Security Operations, SOC analysis, detection and response, incident response, cloud security operations, or a similar hands-on security role.
Hands-on experience with SIEM-based investigations, including alert triage, log analysis, event correlation, evidence review, case prioritization, and escalation.
Experience working with security telemetry from cloud platforms, identity providers, endpoints, SaaS systems, network tools, application logs, and production environments.
Familiarity with cloud-native environments, including IAM, storage access, workloads, Kubernetes, containers, APIs, logging, monitoring, and CI/CD pipelines.
Understanding of common attack techniques, including credential compromise, phishing, privilege escalation, suspicious API activity, malware, data exposure, lateral movement, and cloud misconfigurations.
Experience with identity and endpoint investigation, including SSO, MFA, service accounts, privileged access, EDR alerts, and suspicious user or device activity.
Ability to use query or scripting languages such as KQL, SPL, SQL, Python, Bash, or similar.
Familiarity with incident response workflows, case management, evidence collection, remediation tracking, and post-incident review.
Strong analytical judgment, with the ability to separate false positives from real risk and explain findings clearly.
Ability to work independently, document investigations clearly, and escalate issues with the right level of urgency.
Strong communication skills and the ability to work with Security, IT, DevOps, R&D, Product Security, Compliance, and business stakeholders.
Close attention to detail, strong ownership, and comfort working in a fast-moving production environment.