דרושים » אבטחת מידע וסייבר » Incident Response & Threat Hunting לארגון רפואי באזור המרכז

Requirements:
4+ years of experience in tactical threat hunting, cyber threat intelligence (CTI), DFIR, or advanced security operations.
Strong background in tactical threat intelligence, specifically identifying the discrete traces, artifacts, and behavioral fingerprints left by adversaries across diverse telemetry sources (endpoint, network, cloud, and identity).
Experience capturing and modelling incident data to map out intrusions and understand attacker behaviours.
Proven ability to develop & deliver verbal & written technical findings of attacker behaviour into clear, high-impact notifications for customers.
Experience translating threat intelligence into high-fidelity hunting hypotheses, detection logic, and log-based queries.
Preferred Qualifications
Experience in an Incident Response or Managed Services environment
Proficiency in Python and SQL
Familiarity with malware analysis
Published security blogs or research that shows a deep understanding of a particular threat.

Requirements:
4+ years in security engineering, cloud operations, incident response, threat hunting, DevSecOps, or related security disciplines.
2+ years of hands-on experience securing or operating environments within Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Infrastructure (GCI/GCP).
Strong experience with Kubernetes, containers, and modern cloud-native architectures.
Deep understanding of cloud networking concepts, including VPC Flow Logs, Transit Gateways, service meshes, and traffic patterns (East-West vs. North-South).
Strong comprehension of identity systems (IAM) and how policies interact with network controls to establish secure boundaries.
Experience with CI/CD pipelines and modern software delivery practices.
Proven experience with incident triage, investigations, containment, remediation, or formal operational response processes.
Experience with posture management, governance controls, or applying security best practices such as CIS Benchmarks and recognized cloud architecture frameworks.
Strong scripting or programming proficiency in languages such as Python, Go, or Bash.
Excellent communication skills, demonstrating the ability to clearly explain complex findings and facilitate alignment across cross-functional teams.
Preferred Qualifications
Experience working with large-scale data pipelines and analytics platforms such as BigQuery or Dataflow.
Familiarity with threat frameworks such as MITRE ATT&CK.
Recognized expertise or advanced certifications in cloud security, detection and response, or posture management across Amazon Web Services, Microsoft Azure, or Google Cloud.
Experience operating highly available, large-scale cloud environments.

Requirements:
Required Qualifications
4+ years of experience in at least one of the following fields: Threat Intelligence, Threat Hunting, Malware Analysis, Security Research, SOC (Level 3), or Incident Response.
Deep understanding of the cyber threat landscape, including advanced malware and threat actor techniques. A strong command of the MITRE ATT&CK framework is a must.
Strong proficiency in Python, specifically for automating data collection via APIs and performing data analysis.
Proven experience using BigQuery or SQL-based languages to query massive datasets and identify anomalies.
Strong understanding of OS internals (e.g., processes, registry, memory, file system events) and OS event logs.
Hands-on experience simulating attacks or performing static and dynamic malware analysis in a controlled lab environment.
Analytical Mindset: Ability to analyze large amounts of technical data, extract crucial details, and draw meaningful conclusions.
Independence: Ability to work independently, lead projects to fruition, and collaborate across the company with other departments.
High proficiency in English, both verbal and written.
Preferred Qualifications
Experience in OSINT or intelligence analysis (e.g., military intelligence).
Experience with EDR/XDR platforms, YARA, or Sigma rules.
Strong presentation and public speaking skills.

Requirements:
1-2 years of hands-on experience in IT, SOC, or Security Engineering.

Scripting skills in Python; familiarity with JavaScript or Bash is a plus.

Comfortable working with REST APIs, JSON, and webhooks.

Understanding of networking and protocol fundamentals: TCP/IP, DNS, HTTP, authentication flows.

Familiarity with at least one SOAR platform is a strong plus.

Exposure to SIEM, EDR, or cloud security tools is a plus.

Attention to detail and structured thinking.

Clear written communication.

Requirements:
At least 3 years of experience in security research, fraud research, detection engineering, threat research, mobile security research, browser security research, or a similar hands-on technical role.
Bachelors degree in Computer Science, Cybersecurity, Data Science, or a related field or equivalent hands-on experience.
Strong hands-on experience with at least one of the following areas:
Desktop or mobile browsers, browser APIs, browser automation, browser fingerprinting, web signals, or client-side web security.
Native mobile applications for Android or iOS, mobile OS behavior, device signals, emulators, mobile automation, app instrumentation, or mobile security.
Strong understanding of web technologies, mobile technologies, APIs, application behavior, and modern attack techniques.
Strong Python skills and experience building research tools, automation, data analysis workflows, detection prototypes, or feature engineering pipelines.
Experience analyzing messy real-world data, investigating anomalies, validating hypotheses, and drawing practical conclusions from incomplete information.
Familiarity with machine learning training and validation concepts, such as train/test split, validation sets, overfitting, leakage, feature quality, precision/recall, false positives, false negatives, and model evaluation.
Ability to produce data features in a structured, reliable, and model-friendly way.
Ability to think like an attacker while designing reliable, scalable, and explainable defenses.
Strong problem-solving skills, independence, persistence, and a getting things done attitude.
Excellent communication and interpersonal skills.
Ability to work closely with engineering, product, and data science teams and translate research insights into practical product capabilities.

Requirements:
At least 5 years of experience in cyber security research space
At least 3 years of experience with endpoint security research or offensive \ defensive low-level, file related realms
Proven experience in the low level world, including OS internals, dynamic and static analysis of malware and software and reverse engineering
Proven experience in running end-to-end research POCs from ideas to customer impact solutions including the design, execution, analysis and conclusions of your research, methodologies and outcomes
Investigation skills and critical thinking using analytics, data mining, and data interpretation
Familiarity with analysis of various file types
Proficient hands-on coding skills in Python
Experience with SQL or related query languages
Excellent communication skills - ability to present research results in a clear and meaningful manner
Preferred Qualifications
Proficiency in C \ CPP
Experience with data-driven or ML models
Experience with big data platforms (e.g GCP).