דרושים » אבטחת מידע וסייבר » Head of Managed Security Services - SOC Security Operations

The Services Operations Center (SOC) is a team within Customer Success whose function is to monitor the quality of service of our company clusters deployed in the field, and take the necessary actions in the case of service degradation or outage. The person that works in a SOC is a SOC Operator. This person will be looking at a dashboard of monitored items, and when green lights turn red, they will click on the red light, read a runbook, and endeavor to resolve the issue. If they can fix the problem in 30 mins, they will. If they can not fix the problem, they will declare an incident and page in Support who will begin troubleshooting, and begin keeping a timeline of events. If Support can't fix the problem, the SOC Operator will page in R&D. The SOC Operator will 'run' the incident until the issue is resolved. Once resolution occurs, the SOC operator close out ticket, and publish a Preliminary Findings Report in the ticket. All the while, the SOC Operator will provide a play-by-play in the internal slack channel to keep everyone aware of what's happening.
Job Description
Job Summary: As a SOC Operator, you will be responsible for monitoring and maintaining the health and performance of our fleet of installed clusters. You will work in a 24/7 operations environment, ensuring the availability, reliability, and security of services. This role involves real-time monitoring, incident detection, incident management, incident resolution, and clear written and verbal communication with other teams and stakeholders.
Responsibilities:
Monitor clusters using internal monitoring tools to detect and troubleshoot issues promptly.
Respond to alerts and incidents in a timely manner, following standard operating procedures (SOPs) and escalation processes.
Perform initial investigation and diagnosis of problems, escalating complex issues to support or R&D.
Document incidents, including their details, troubleshooting steps, and resolutions in the incident tracking system.
Collaborate with other teams, including Support, R&D, Account teams, and customers to ensure effective incident resolution and communication.
Conduct routine checks and audits to identify potential problems or vulnerabilities.
Assist with the implementation of changes and updates to the infrastructure as directed by team leads.
Participate in shift-based work schedules, including nights, weekends, and holidays, to provide 24/7 coverage in the SOC.
Maintain up-to-date knowledge of storage technologies, industry trends, and best practices.
Adhere to security protocols and ensure the confidentiality, integrity, and availability of network and system data.
Contribute to the development and improvement of SOC processes and procedures.
Provide excellent customer service to internal and external stakeholders during incident resolution and communication.
High school diploma or equivalent; a degree or certification in information technology or a related field is a plus.
Proven experience as a SOC Operator or in a similar network monitoring role is preferred.
Strong understanding of networking concepts, protocols, and technologies (TCP/IP, SNMP, DHCP, DNS, etc.).
Ability to work independently and collaboratively in a team-based environment.
Excellent problem-solving and analytical skills, with the ability to multitask effectively.
Good communication skills, both written and verbal, to interact with technical and non-technical stakeholders.
Willingness to work in a 24/7 shift-based environment, including nights, weekends, and holidays.
Detail-oriented and committed to maintaining accurate documentation.
Demonstrated commitment to continuous learning and self-improvement.

You will be the only SOC analyst based in Israel, while the rest of the analyst team operates from the Philippines. You will act as the SOCs local anchor - the on-site technical counterpart for the Israel-based Cyber Security, IT, Operations, and R&D teams, and the escalation and knowledge bridge between them and the offshore shifts. The role calls for ownership, independence, and the appetite to build and improve, not only to operate.

Responsibilities

Monitoring and Detection: Continuously monitor SIEM, endpoint protection (EDR), IPS, mail security, CASB, cloud, and identity security solutions to identify potential threats.
Incident Response: Serve as one of the first levels of escalation for security incidents - investigate, contain, and drive resolution before escalating to the senior SecOps members, in accordance with defined procedures and SLAs.
Incident Coordination: Lead coordination of major incidents until ownership is transferred to the relevant SecOps, IT, Operations, or R&D team; ensure clear communication, escalation, and tracking of action items.
Threat Analysis: Analyze logs, network traffic, endpoint telemetry, and native (in-tool) alerts to determine root cause, scope, impact, and remediation steps.
SIEM and Detection Engineering: Own day-to-day operation of the SIEM - data onboarding and ingest pipelines, field mapping and data quality, dashboards and platform health - and write, tune, and maintain detection rules while measuring their effectiveness.
Exclusion and Exception Management: Own the exclusion and exception lifecycle across the security stack: review requests, assess risk, apply scoped, time-bound exclusions, and revalidate them periodically.
Automation and AI-Assisted Operations: Build and maintain automations across the SOC toolchain (enrichment, containment, ticketing, reporting), and design, implement, and validate AI/LLM-based workflows for alert triage, investigation support, and documentation - including guardrails and quality control of AI output.
Investigation Documentation: Create and maintain detailed incident tickets, including investigation audit trail, action items, and timelines.
Technical Leadership: Act as the senior operational reference for the analyst team: help prioritize workload, assure investigation quality, maintain consistent handling of incidents, escalations, and shift handovers, and mentor analysts on tooling and methodology.
Collaboration: Work closely with the Cyber Security team, IT, Operations, and R&D locally, and with the offshore SOC team across time zones.
Continuous Improvement: Drive improvements to detection logic, automation, operational runbooks, and shift handover documentation based on lessons learned from incidents.
Compliance and Reporting: Support reporting for compliance audits, management reviews, and threat intelligence updates.

We are looking for an experienced and highly driven Head of Security to join our Security leadership team, reporting directly to the CISO.

This is a unique opportunity to play a key leadership role in shaping and scaling the security program of a fast-growing fintech company. As Head of Security, you will serve as the CISO's trusted partner, helping drive the organization's security strategy while leading day-to-day execution across multiple security domains.

Yo will oversee both the Security Operations , Security Engineering and GRC organizations, managing team leads and security professionals across Israel and abroad. This role requires a strong combination of strategic thinking, technical depth, operational excellence, and people leadership.

The ideal candidate brings experience from large-scale, cloud-native environments and has successfully led security programs spanning Security Operations, Security Engineering, Compliance, Risk Management, and Security Architecture. You will work closely with Engineering, Infrastructure, IT, Product, Legal, Compliance, and executive leadership teams to continuously strengthen our security posture while enabling business growth.

What You'll Do
Drive execution of strategic security initiatives across the organization.
Partner closely with the CISO to define and execute our security strategy and roadmap.
Translate business objectives into scalable security programs and controls.
Act as a key stakeholder in security governance, risk management, and decision-making processes.
Help shape the future of Security, including emerging domains such as AI Security and Security Automation.

Organizational Leadership & Business Partnership
Lead and mentor multiple security teams, including Security Operations and Security Engineering, through direct management of team leaders and global security personnel.
Build scalable operating models, KPIs, governance processes, and organizational structures that support Sunbit's rapid growth and global expansion.
Partner closely with Engineering, Infrastructure, Product, IT, Legal, Compliance, Privacy, Risk, and Business leaders to ensure security enables business objectives while managing risk appropriately.
Collaborate extensively with US-based stakeholders and cross-functional teams in a dynamic global environment.
Drive the adoption of AI, automation, and emerging technologies to improve security effectiveness, operational efficiency, and scalability.

Required Sr MSIAM SOC Engineer (Unit 42)
Job Summary
As a Senior SOC Engineer within Unit 42, you will drive the creation, validation, and optimization of custom detection rules and automated playbooks across our global customer base. Acting as a trusted advisor, you will collaborate closely with clients to maximize their security posture using Cortex XSIAM and Unit 42 expertise. This highly analytical role leverages your deep understanding of detection lifecycles, proactive automation, and threat intelligence to secure enterprise environments. You will architect end-to-end security lifecycles that seamlessly connect data ingestion with high-fidelity detection engineering.
Key Responsibilities:
Own the full lifecycle of custom detections and response automations, deploying them as high-fidelity Cortex XSIAM correlation rules and playbooks through a rigorous engineering process of development, testing, staging, and soft implementation.
Drive the continuous refinement of correlation rules to ensure strict standards for performance, accuracy, and operational relevance.
Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable, robust detection logic.
Champion proactive automation by engineering sophisticated playbooks to resolve emerging security challenges and optimize operational workflows ahead of demand.
Architect the end-to-end security lifecycle within Cortex XSIAM, seamlessly connecting data ingestion, high-fidelity detection engineering, and sophisticated response automation.

As a Senior SOC Engineer within Unit 42 at Palo Alto Networks, you will drive the creation, validation, and optimization of custom detection rules and automated playbooks across our global customer base. Acting as a trusted advisor, you will collaborate closely with clients to maximize their security posture using Cortex XSIAM and Unit 42 expertise. This highly analytical role leverages your deep understanding of detection lifecycles, proactive automation, and threat intelligence to secure enterprise environments. You will architect end-to-end security lifecycles that seamlessly connect data ingestion with high-fidelity detection engineering.
Key Responsibilities
Own the full lifecycle of custom detections and response automations, deploying them as high-fidelity Cortex XSIAM correlation rules and playbooks through a rigorous engineering process of development, testing, staging, and soft implementation.
Drive the continuous refinement of correlation rules to ensure strict standards for performance, accuracy, and operational relevance.
Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable, robust detection logic.
Champion proactive automation by engineering sophisticated playbooks to resolve emerging security challenges and optimize operational workflows ahead of demand.
Architect the end-to-end security lifecycle within Cortex XSIAM, seamlessly connecting data ingestion, high-fidelity detection engineering, and sophisticated response automation.

Technical Leadership: Provide authority guidance within the Splunk security domain, exhibiting deep expertise in SIEM, SOAR, and Observability integrations.

Strategic Advisory: Lead sophisticated, multi-functional security projects, acting as a trusted partner to CISO and IT leadership.

Solution Delivery: Lead the strategic planning, compose, and implementation of tailored Splunk security architectures to mitigate risk and maximize technology investments.

AI-Driven Security: Apply sophisticated AI and automation tools to optimize security operations, automate incident response, and improve detection efficacy.

Customer Management: Develop and maintain high-value relationships, ensuring technical alignment with customer security objectives.

Documentation Excellence: Define and implement documentation standards for sophisticated security deployments, ensuring transparency and structure for technical assets.

Authority Support: Build and apply advanced simulation environments; provide expert support for sophisticated security issues and platform challenges.

Mentorship & Growth: Build technical skills across the team, serving as a domain expert on Plan, Design, Implement, and Optimize (PDIO) methodologies.

Product Influence: Synthesize customer feedback to prioritize and advocate for Splunk product and service improvements.

Innovation: Apply expertise in security orchestration, automation, and AI Ops to deliver innovative, scalable customer outcomes.

Intellectual Capital: Lead the creation of digital assets, procedures, and standardized methodologies for Splunk security engagements.

multi-functional Partnership: Collaborate with Product Management to track security trends, influence service offers, and share actionable customer insights.

we are looking for a MXDR Analyst to join the team of cybersecurity analysts monitoring services 24/7. The role includes development of detection analyses, triage of alerts, investigation of security incidents, proactive threat hunting and enhancement of sensors and overall visibility status.
The suitable candidate should be a team player with previous experience in SOC, SecOps or security monitoring, independent, and with a can-do attitude.
Responsibilities:
Working across all areas of Sygnias SOC, including continuous monitoring and analysis, threat hunting, security compliance, security event auditing and analysis, rule development and tuning, and forensics.
Solving security incidents in accordance with defined service level agreements and objectives.
Prioritizing and differentiating between potential incidents and false alarms.
Addressing clients enquiries via phone, email, and live chat.
Working side-by-side with customers, providing insightful incident reports.
Working closely with peers and higher-tier analysts to ensure that your analysis work meets quality standards.
Identifying opportunities for improvement and automation within the MXDR Operation Lead, and leading efforts to operationalize ideas.
Identifying and offering solutions to gaps in current capabilities, visibility, and security posture.
Correlating information from disparate sources to develop novel detection methods.

What am I going to do?
Own complex Trust & Safety operational initiatives from definition through execution, rollout and measurement.
Lead operational aspects of new moderation technologies, external vendor integrations and tooling improvements, including solutions such as automated and AI-assisted moderation.
Act as the operational owner for integrations: define requirements, identify dependencies, coordinate Product, Engineering, Data, Policy, Legal and vendor stakeholders, manage timelines and drive decisions to closure.
Translate T&S problems and policy requirements into scalable operational workflows, enforcement logic, rules, tooling requirements and implementation plans.
Continuously identify operational gaps, inefficiencies and emerging abuse trends and proactively propose solutions rather than waiting for predefined projects.
Build and improve moderation workflows across automation and human review, balancing accuracy, operational efficiency, user impact and business needs.
Own relationships with relevant moderation and T&S vendors, including implementation, performance management, escalation and ongoing optimization.
Drive cross-functional projects involving Policy, Product, Engineering, Data Science, Legal, Customer Care, QA and Training.
Support incident and escalation management when operational or platform-integrity risks require rapid cross-functional response.
Help shape the longer-term operating model and capabilities of the Trust & Safety function.

We are seeking a Head of Research to build and lead our research group reporting to the Co-founder and CTO. You'll set the research agenda for how AI agents, spanning coding agents, SaaS AI platforms, cloud, and endpoints, can be abused, and you'll turn that research into the detections and runtime protections that define our product. You'll build the team, the threat intelligence function, and the processes that keep us ahead of a threat landscape that changes weekly. This is a hands-on leadership role. You'll still go deep on platforms and attack paths while scaling research into a core differentiator of the company. You will help define the field of Agentic Security and be one of its leading voices.

Responsibilities

Lead and grow the research team: Hire, mentor, and manage AI security researchers. Build a culture of rigor, speed, and ownership.

Own the research direction: Proactively identify emerging agentic threats and platforms, prioritize research projects, and set a roadmap aligned with product and customer needs.

Build threat intelligence processes: Establish how we collects, triages, and operationalizes threat intelligence on agentic attacks. This includes in-the-wild abuse, malicious MCP servers, skills and extensions, and new techniques from the research community.

Drive research into product: Partner closely with engineering and product so findings become production detections, runtime policies, and governance capabilities. Own the coverage and quality of our detection logic.

Define detection strategy: Set standards for detection logic across environments, including coverage models, efficacy measurement, and false positive and false negative management at enterprise scale.

Stay hands-on: Lead deep dives into platform architectures, monitoring and enforcement boundaries, and end-to-end PoCs for the most critical attack paths.

Represent us externally: Publish research, advisories, and vulnerability disclosures. Speak at leading security conferences and build our reputation as the authority on agentic security.

Support customers and the field: Provide research expertise for customer engagements, incident investigations, and strategic accounts.