דרושים » אבטחת מידע וסייבר » Senior DFIR Analyst

This is a hands-on role that balances deep technical work along with building and running the function: the Lead drives high-severity incidents end-to-end, serves as the escalation ceiling, and sets the standards and structure the team operates by.

Youre welcome to work in our offices in Tel Aviv, Israel.

Your responsibilities will include:

Build and lead global DFIR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders.
Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases.
Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction.
Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements.
Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR.
Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA).
Raise the teams technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness.

we are looking for highly capable Incident Response Expert. The Incident Response Expert role includes conducting in-depth forensic analysis, investigation and response to real-world cyber threats. A significant part of our investigations is performed onsite at the client location, in collaboration with the clients IT and security teams.
Main Responsibilities:
Participate in forensic and incident response investigations, including large scale sophisticated attacks, conduct log analysis, host and network-based forensics and malware analysis.
Participate in threat hunting: proactively hunt for targeted attacks and new emerging threats in clients networks; as well as security assessments and simulations.
Identify indicators of compromise (IOCs) and tools, tactics, and procedures (TTPs) to help ascertain whether and how breaches have occurred.
Utilize and develop tools and methodologies to improve Sygnias existing investigative and hunting technological stack.
Collaborate with IT and Security teams during investigations.
Generate and present a comprehensive and professional report of findings from investigations.

we are looking for an experienced Incident Response Manager (IRM) to lead incident response services for clients across EMEA. This is a senior management role within Incident Response department and an integral part of the companys global IR service delivery organization.
The role combines technical leadership, crisis management, client engagement, and cross-functional project leadership. Following a substantial and successful tenure in the position, the IRM will have opportunities for continued professional growth and advancement across a variety of roles within .
Main Responsibilities:
Lead incident response and threat-hunting engagements involving large-scale and sophisticated cyberattacks, with the objective of containing, mitigating, and defeating real-world threats.
Lead dynamic, cross-functional teams of cybersecurity researchers, forensic experts, and other specialists assembled according to the specific needs of each engagement. Team members do not report directly to the IRM outside the scope of the project.
Maintain clear, concise, and timely internal communication, providing regular updates to technical, financial, legal, business, and executive stakeholders within .
Lead client-facing communication throughout investigations and work closely with clients IT, security, legal, and executive teams, as well as relevant external stakeholders.
Serve as a trusted advisor to clients during high-pressure and business-critical situations.
Collaborate with global teams to ensure consistent, high-quality incident response delivery across regions.
Strengthen client relationships, identify relevant business opportunities, and support the introduction of additional services.
Contribute to broader strategic objectives through professional publications, thought leadership, marketing initiatives, and business development activities.
Design, develop, and continuously improve internal incident response methodologies, processes, and capabilities.

Were looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.
As a Staff Software Engineer in the Detection Platform group, you will be responsible for defining and evolving the architecture of the cloud-native systems that power our AI SIEM detection, hunting, and response capabilities, including large-scale real-time detection engines, stateful detection engines, anomaly detections, ML pipelines, agentic SOC and threat-hunting capabilities. You will participate in the design and execution of backend systems that process billions of events and several petabytes of data daily and serve tens of thousands of security specialists at enterprise and government customers worldwide.

You will be the only SOC analyst based in Israel, while the rest of the analyst team operates from the Philippines. You will act as the SOCs local anchor - the on-site technical counterpart for the Israel-based Cyber Security, IT, Operations, and R&D teams, and the escalation and knowledge bridge between them and the offshore shifts. The role calls for ownership, independence, and the appetite to build and improve, not only to operate.

Responsibilities

Monitoring and Detection: Continuously monitor SIEM, endpoint protection (EDR), IPS, mail security, CASB, cloud, and identity security solutions to identify potential threats.
Incident Response: Serve as one of the first levels of escalation for security incidents - investigate, contain, and drive resolution before escalating to the senior SecOps members, in accordance with defined procedures and SLAs.
Incident Coordination: Lead coordination of major incidents until ownership is transferred to the relevant SecOps, IT, Operations, or R&D team; ensure clear communication, escalation, and tracking of action items.
Threat Analysis: Analyze logs, network traffic, endpoint telemetry, and native (in-tool) alerts to determine root cause, scope, impact, and remediation steps.
SIEM and Detection Engineering: Own day-to-day operation of the SIEM - data onboarding and ingest pipelines, field mapping and data quality, dashboards and platform health - and write, tune, and maintain detection rules while measuring their effectiveness.
Exclusion and Exception Management: Own the exclusion and exception lifecycle across the security stack: review requests, assess risk, apply scoped, time-bound exclusions, and revalidate them periodically.
Automation and AI-Assisted Operations: Build and maintain automations across the SOC toolchain (enrichment, containment, ticketing, reporting), and design, implement, and validate AI/LLM-based workflows for alert triage, investigation support, and documentation - including guardrails and quality control of AI output.
Investigation Documentation: Create and maintain detailed incident tickets, including investigation audit trail, action items, and timelines.
Technical Leadership: Act as the senior operational reference for the analyst team: help prioritize workload, assure investigation quality, maintain consistent handling of incidents, escalations, and shift handovers, and mentor analysts on tooling and methodology.
Collaboration: Work closely with the Cyber Security team, IT, Operations, and R&D locally, and with the offshore SOC team across time zones.
Continuous Improvement: Drive improvements to detection logic, automation, operational runbooks, and shift handover documentation based on lessons learned from incidents.
Compliance and Reporting: Support reporting for compliance audits, management reviews, and threat intelligence updates.

We are looking for a Senior Fraud Analyst to serve as the technical cornerstone of our Fraud Prevention team.
In this role, you won't be managing a team; youll be managing the technical evolution of our fraud defenses. Reporting directly to the Fraud Prevention Director, you will act as a high-level individual contributor, bridging the gap between data science, engineering, and risk strategy. You will be responsible for pioneering the use of AI and advanced analytics to protect our community and ensure our platform remains the safest place for independent businesses to grow.
Here are a few of the things you'll do:
Technical Strategy & Architecture: Partner with the Fraud Prevention Director to define the long-term technical roadmap, moving toward an AI-first, autonomous fraud detection ecosystem.
AI & LLM Integration: Design and implement Generative AI agents and LLM-powered workflows to automate complex forensic investigations, reducing the time-to-detect for emerging fraud vectors.
Advanced Detection Modeling: Develop and prototype sophisticated ML models and graph-based heuristics to identify collusion, synthetic identities, and fraud rings.
Cross-Functional Technical Lead: Serve as the primary technical consultant to Product and Engineering, ensuring that new payment features (like RTP or international expansion) are built with scalable, AI-driven safeguards from day one.
Expert Forensics: Act as an escalation point on high-stakes, large-scale fraud attacks, utilizing advanced Python and network analytics to deconstruct and mitigate threats.
Data Excellence: Set the standard for the fraud teams technical stack. You will optimize our SQL/Python environments and ensure our data infrastructure is capable of supporting real-time AI inference.

Required Senior Detection & Response Analyst
Job Summary
Join our brand new D&R team and help service our biggest customers, who trust us to offer a tailored service responding to high-severity threats across their enterprises. As a leading AI SOC platform covering the full SecOps lifecycle from triage to response, we blend deep security expertise with cutting-edge AI. We investigate every alert at forensic depth, disrupting the traditional MDR market and empowering security teams at companies like Nvidia, MGM Resorts, Salesforce, and Equifax. If you're excited to jump in, do high-impact work, and help shape how modern SOCs operate as we grow fast, we'd love to have you.
Responsibilities:
Investigate and resolve high-severity threats escalated by our AI SOC platform across major enterprise customers
Lead triage, containment, and remediation of live incidents, working directly with customer security teams
Write and maintain playbooks, detection content, and escalation procedures under the direction of the Head of Detection & Response
Communicate findings clearly to customer SOC teams and stakeholders, translating technical detail into risk and recommended actions
Feed real-world incident learnings back to Product and Research to improve detection logic and the platform itself
Use AI-native tooling and automation to scale your own output, and help shape how the team works with it
Participate in an on-call rotation for critical customer incidents.

we are seeking a deeply experienced Security Analyst - Tier 3 for its Security Operations Center (SOC). This role is a senior individual-contributor position, leading challenging investigations, setting the standards the SOC operates by. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office.

Your responsibilities will include:

Lead complex, multi-stage, multi-domain investigations end to end, from scoping through deep technical analysis to a clear determination of impact and root cause.
Serve as the SOC's senior escalation point and the quality gate for investigations across the team.
Support the Incident Response team during confirmed incidents with continued telemetry investigation, scoping, and analytical depth.
Continuously sharpen how the SOC investigates, identifying gaps in methods, runbooks, and tooling through daily casework and turning them into concrete improvements.
Mentor Tier 1 and Tier 2 analysts through case reviews, coaching, and pairing during investigations.
Partner with Security Engineering, Platform Security, Threat Intelligence, SOC Automation, and additional teams to turn what the SOC learns into stronger detection and response across .
Participate in readiness activities - tabletops, post-incident reviews, and purple-team engagements.
Participate in the on-call rotation as the senior point of contact outside business hours.

Were looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.
Join the Detection AI Research team, where security research meets machine learning. We use EDR telemetry from millions of endpoints to hunt for sophisticated, highly evasive attacks and to close the coverage gaps they expose, using ML models and LLM-based agents that we design, build, and run in production. As a Senior Security Researcher in our AI Detection research team, you will bring the attacker's-eye view: which techniques matter, how they look in endpoint data, and what separates a real intrusion from benign noise at scale. You will work alongside the data scientists who build our models, and your detections will reach real customers through Wayfinder analysts, threat hunters and detection engines.

we are seeking an experienced Security Analyst - Tier 2 for its Security Operations Center (SOC). This role is a hands-on position built for depth, serving as the investigative core of the SOC, focused on evidence and grounded conclusions. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office.

You are welcome to work in our offices in Tel Aviv, Israel.

Key Responsibilities
Investigate escalated security alerts across endpoint, identity, cloud, email, and network layers.
Determine scope, impact, and root cause using EDR, SIEM, and supporting telemetry.
Escalate suspected incidents to the Incident Response team and complex investigations to Tier 3.
Provide structured feedback to relevant stakeholders on detection or prevention quality, false-positive patterns, and coverage gaps discovered during investigations.
Contribute to and refine SOC runbooks, triage guides, and investigation procedures.
Review Tier 1 escalations, coach on handoff quality, and act as the analytical reference during triage.
Document investigations to a standard that supports handoff, quality review, and lessons learned.
Participate in the on-call rotation, acting as the investigative point of contact outside business hours.