דרושים » אבטחת מידע וסייבר » Head of Proactive Security

The Cyber Threat Intelligence Hunter will sit within Unit 42 Managed Threat Hunting and support proactive, intelligence-led hunting across customer environments. This role combines hands-on threat hunting with cyber threat intelligence analysis, helping multinational organizations stay one step ahead of adversaries and cyber threats.
Key Responsibilities
Analyze public and private threat intelligence, Unit 42 research, adversary campaigns, malware activity, infrastructure, indicators, and TTPs.
Translate threat intelligence into actionable hunting hypotheses, investigation workflows, hunting queries, and customer-facing findings.
Execute existing threat hunting reports and hunting workflows, investigate results, and support timely customer reporting.
Investigate scheduled hunt detections and compose clear, professional reports when relevant.
Investigate hunting leads based on IOCs, threat intelligence, internal detections, customer telemetry, and emerging adversary behaviors.
Monitor the threat landscape and prepare initial context for emerging campaigns, enabling the global team to continue deeper investigation and hunting.
Collaborate with threat hunters, detection engineers, incident responders, MDR, and Unit 42 researchers to operationalize intelligence quickly and effectively.
Escalate major, unclear, or high-impact security events to the Threat Hunting leadership team when necessary.
Provide ongoing feedback on findings, hunting reports, queries, intelligence workflows, and operational processes to support continuous improvement.

we are looking for a Lead Detection Engineer.This is an individual contributor role with full technical ownership. You'll set the direction for detection engineering: the standards, the tooling, the coverage strategy, and the automation that operationalizes it all. You'll work closely with SOC analysts and Platform Engineering to make detection a first-class engineering discipline.

Youre welcome to work in our offices in Tel Aviv, Israel

Your responsibilities will include:

Detection coverage strategy across endpoint, identity, cloud, and infrastructure - how it's measured, prioritized, and continuously improved.
Detection-as-Code pipeline: version control, testing, peer review, CI/CD, and deployment practices for all detection logic.
Architecture connecting detections to enrichment, triage, and automated response workflows.
Technical standards for how detections are designed, tested, documented, deployed, and retired.
Detection quality: fidelity metrics, false positive reduction, coverage measurement, and continuous validation loops.
Design and build high-fidelity behavioral detections across SIEM and EDR platforms.
Research emerging attacker techniques and translate threat intelligence into scalable, evasion-resistant detections.
Validate detections through threat simulations and continuous detection testing.
Partner with SOC analysts to close the feedback loop between detections and real investigations.
Define and track detection engineering metrics; communicate coverage posture and effectiveness to security leadership.
Make architectural decisions that scale as the team and organization grow.

This is a hands-on role that balances deep technical work along with building and running the function: the Lead drives high-severity incidents end-to-end, serves as the escalation ceiling, and sets the standards and structure the team operates by.

Youre welcome to work in our offices in Tel Aviv, Israel.

Your responsibilities will include:

Build and lead global DFIR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders.
Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases.
Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction.
Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements.
Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR.
Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA).
Raise the teams technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness.

As a SecOps Lead , you will own the core of the security operations function: detection, response, automation, and the processes that connect them. You will guide incident response from first alert through post-mortem, keeping efforts structured and stakeholders informed along the way. You will shape how the team detects, triages, and resolves, and communicate that work clearly to leadership, engineering, and customers.

This is a hands-on role with broad ownership. You should be comfortable writing a detection rule, coordinating a live incident, and walking stakeholders through a post-incident review.

Key Responsibilities

Lead Incident Response: Own the end-to-end incident response lifecycle across infrastructure and enterprise browser platform, driving investigations, coordinating responders, and ensuring timely resolution and post-incident improvements.
Own the IR Framework: Build, maintain, and continuously improve incident response processes, including runbooks, severity definitions, escalation paths, on-call procedures, and communication standards.
Drive Detection Engineering: Design, implement, and continuously improve high-fidelity detections across SIEM, EDR, cloud, and endpoint security platforms, closing visibility gaps and strengthening detection coverage.
Automate Security Operations: Build automation and AI-driven workflows that streamline triage, investigation, enrichment, and response, reducing manual effort and improving operational efficiency.
Threat Hunting & Research: Proactively hunt for threats, leverage threat intelligence, and identify emerging attack techniques relevant to modern enterprise environments.
Own Security Operations: Serve as the technical owner for Security Operations within Product Security, driving strategy, setting best practices, and continuously improving detection and response capabilities.
Partner Across Engineering: Collaborate closely with Engineering, IT, Infrastructure, and Compliance teams to embed security into new services, infrastructure changes, FedRAMP initiatives, and customer-facing security requirements.
Communicate During Incidents: Provide clear, timely communication throughout incident response, keeping technical teams, leadership, and stakeholders aligned on impact, progress, risks, and next steps.

we are looking for a Head of Security Reliability to establish and lead the Security Reliability pillar. Reporting directly to the CISO, this leader will be accountable for the ongoing effectiveness, resilience, and operational maturity of security products after implementation.

The role ensures that security platforms remain properly configured, maintained, integrated, monitored, adopted, and optimized to deliver measurable risk reduction. It also owns Third-Party Risk Management (TPRM) program and the security-review process for new products, services, and technologies introduced across the company.

This is a hands-on leadership position for someone who combines security expertise, operational discipline, vendor-management experience, and a strong product mindset. The role partners closely with Security, IT, Engineering, Product, Procurement, Legal, Privacy, Compliance, and business stakeholders.

Key responsibilities

Security product reliability and lifecycle ownership

Own security products and platforms after implementation, from operational handover through optimization, renewal, replacement, or retirement.
Ensure security tools are correctly configured, maintained, integrated, monitored, and aligned with Nebius's risk profile and technical environment.
Define ownership, service levels, operating procedures, support models, and escalation paths for every security platform.
Monitor platform availability, data quality, control coverage, integration health, licensing, capacity, and performance.
Establish disciplined processes for upgrades, configuration changes, testing, exception management, and end-of-life planning.
Continuously assess whether security products deliver their intended outcomes, and improve utilization, coverage, automation, and return on investment.
Reduce overlapping capabilities, configuration drift, operational gaps, and underused tooling across the security stack.
Manage vendor performance, technical escalations, product-roadmap discussions, renewals, and service reviews.
Ensure newly implemented security products transition into operations with clear documentation, ownership, monitoring, and success criteria.
Security configuration and control assurance

Define and maintain secure configuration baselines for security platforms.
Establish continuous control-health monitoring to identify disabled, degraded, misconfigured, or incomplete controls.
Validate that integrations and telemetry remain complete, accurate, and reliable as environment evolves.
Coordinate remediation of control gaps with Security, IT, Engineering, and platform owners.
Maintain evidence demonstrating the operational effectiveness of security controls for audits, certifications, and customer-assurance activities.

Required Security Operations Team Lead
The Security & Information team is looking for someone who is passionate about technology and has a roll-up-their-sleeves mentality to join our global team. Youll play a crucial role in enhancing our security infrastructure, improving networking, ensuring scalability, and maintaining strong security as we continue to grow. If you want to be an industry leader, on a team experiencing hyper-growth, look no further!
What youll do:
As a SecOps Team Lead, youll be responsible for securing and protecting our infrastructure, including orchestrating and administering various internal autonomous processes and workflows. You will partner with technology team to onboard accessible AI workflows, driving the transition from manual SOC operations to an autonomous, agentic model. Youll also provide security expertise and guidance to the team on various security-related matters and build and own solutions to quickly identify breach attempts, contain and eradicate threats, streamline our security incident response processes, continuously test our controls, and help the business make informed decisions based on threat intelligence. This is a fast-paced environment, where youll have the opportunity to manage multiple projects at once.
Responsibilities:
Lead & Mentor: Manage a team of SecOps analysts, providing technical guidance, career development, and performance management in a fast-paced environment.
Act as the primary escalation point for high-priority security incidents, leading the triage, containment, and post-mortem processes for our production and cloud environments.
Lead SecOps projects from inception to execution, ensuring effective implementation and ongoing maintenance.
Coordinate investigation, containment, and other response activities with business stakeholders and groups.
Perform hands-on forensic investigations, log reviews, cloud investigations, and root-cause analysis
AI-Driven Operational Maturity: Proven track record in orchestrating autonomous workflows (e.g., automated phishing triage, AI-driven anomaly detection).
Develop incident analysis and findings reports for management, including gap identification and recommendations for improvement.
Drive SOC Enablement & Modernization: Partner closely with the technology team to streamline and democratize autonomous AI workflows, leading the teams transition from manual operations to an accessible, agentic SOC.

As a Security Operations Engineer , you will be a core member of the SecOps team, owning incident detection, triage, and response across infrastructure and enterprise browser platform. You will work closely with the SecOps Lead to mature our IR capabilities, build the automation and tooling that power our operational workflows, and help keep and its customers ahead of real-world threats.

This is a hands-on, build-and-operate role - ideal for someone who is equally comfortable writing a detection rule, investigating a live incident, and shipping a Torq workflow before end of day.

Key Responsibilities

Incident Response: Lead and participate in the full incident lifecycle - detection, triage, investigation, containment, and post-mortem. Own runbooks and ensure they reflect current threat landscape and tooling.
Detection Engineering: Develop, tune, and maintain detection rules across SIEM, EDR, and security audits. Minimize false positives; maximize signal value.
Security Automation: Build and improve automated response workflows using platforms like Torq; reduce manual toil on alert triage, enrichment, and escalation paths.
Threat Monitoring & Hunting: Continuously monitor the environment for anomalies and indicators of compromise; proactively hunt for threats aligned to our threat model.
Cloud Security Operations: Investigate and triage findings from cloud-native security tooling (Wiz, AWS CloudTrail); collaborate with engineering teams on remediation of infrastructure-level issues.
Tooling & Integrations: Contribute to the ongoing development of the SecOps toolchain - integrating alert sources, building dashboards, and improving the Jira-based alert center.IR Documentation: Maintain incident.io flows, response playbooks, and post-incident reports; contribute to the team's runbook hub.

our companys Harmony SASE is looking for an Information Security Manager to join its staff.
This is a unique opportunity for you to work in the #1 worldwide Cyber Security Company, gain expertise and experience leading the information security program for the best of SASE (Secure Access Service Edge).
Key Responsibilities
As Information Security Manager you will:
Governance, Risk & Compliance
Lead and manage the Product Security team
Build, operate, and continuously improve the Harmony SASE Information Security Management System (ISMS), aligning policies, standards, and controls with our company and industry best practices.
Own the Harmony SASE compliance roadmap - lead and maintain certifications and attestations including ISO/IEC 27001, SOC 2 Type II, GDPR, IRAP and C5
Lead enterprise risk assessments and the third-party / vendor risk program, ensuring risks are identified, prioritized, and treated.
Coordinate internal and external audits, manage evidence collection, and remediate findings to closure.
Product & Application Security
Develop and implement a comprehensive AI - Secure Software Development Lifecycle (AI S-SDLC) framework, embedding security into every phase of the SDLC and CI/CD pipelines.
Conduct threat modeling and secure architecture reviews for new and existing Harmony SASE features, partnering with R&D to mitigate vulnerabilities by design.
Operate the application security tooling stack - ASPM, SAST, DAST, SCA, AI Security Scanning and secret scanning - at scale, and partner with development teams to drive findings to remediation while maintaining developer productivity.
Champion secure coding practices and OWASP Top 10 awareness across R&D.
Operational Security & Incident Response
Lead security incident response for Harmony SASE - preparedness, detection, containment, eradication, recovery, and lessons-learned - covering both product and information security incidents.
Oversee identity and access governance, ensuring least-privilege, segregation of duties, and access reviews across production and corporate environments.
Design and operate security automation to enhance the efficiency and coverage of security operations.
Security Culture & Enablement
Foster a culture of security awareness and continuous improvement; deliver targeted training for engineers, operations, and broader staff.
Lead responses to customer security questionnaires, RFPs, and due-diligence requests, representing Harmony SASEs security posture to customers and partners.
Stay current on the evolving Threats Landscape, regulations, and technologies, and translate them into pragmatic improvements to the security program.

We are on an expedition to find you, a CTI Analyst who is passionate about turning raw threat data into clear, evidence-backed intelligence and operational outcomes. Youll play a major role in advancing our next-gen CTI platform across threat actor attribution, adversary infrastructure analysis, External Attack Surface Management (EASM), and STIX-based knowledge management - Working closely with the Engineering, MLOps, and Data teams to deliver high-signal intelligence that drives action.
:Responsibilities
Execute the CTI research roadmap across threat actor attribution, adversary infrastructure analysis, EASM insights, and STIX-based knowledge management.
Conduct in-depth infrastructure and campaign analysis, including domain/IP relationships, hosting patterns and certificates.
Identify, validate, and track Indicators of Compromise (IOCs) and emerging threats using passive sources and approved active techniques.
Normalize, enrich, deduplicate, and maintain intelligence in STIX 2.1, aligned with internal ontology and quality standards.
Collaborate with the Engineering, MLOps, and Data teams to translate intelligence into actionable intelligence, alerts, and customer-facing outputs.
Produce high-quality intelligence reports, threat briefs, watchlists, and early-warning assessments for internal teams and customers.
Support investigations by providing contextual analysis, confidence scoring, and evidence-backed assessments.
Ensure adherence to governance, ethics, sourcing, provenance, and data-quality standards across all intelligence outputs.

Required Director Application Security
About the Role:
As the Director of Product Security, you will spearhead our efforts to fortify and enhance the security posture of our products and runtime environments and play a critical leadership role in overseeing the design, implementation, and maintenance of security controls for the organizations complex product applications, platform, development and cloud infrastructure.
You will lead a team of security experts and collaborate closely with engineering, product, and other business units to ensure the security and integrity of our applications, platforms, cloud infrastructure, and code stack against current & evolving threats.
Your leadership will be instrumental in embedding security best practices throughout the development and operations pipeline, ensuring a secure and scalable product environment. You will also drive the strategy, development, and implementation of a comprehensive application security program across our cloud-based applications.
Reporting line: VP Security Engineering
What Youll Do:
Strategic Leadership and Team Management:
Strong leadership skills to develop and lead the strategic direction for the Application and Cloud Security teams.
Lead risk assessments, threat modeling, and secure design reviews of cloud platforms to proactively identify vulnerabilities and ensure compliance with security standards.
Oversee the design, implementation, and maintenance of security controls across multi-cloud environments (AWS, GCP, Azure) to protect infrastructure and applications.
Experience in collaborating with cross-functional teams, including engineering, product management, and customer support, to embed security into product development and all aspects of cloud deployments.