דרושים » אבטחת מידע וסייבר » SOC Manager - Security Operations

The Services Operations Center (SOC) is a team within Customer Success whose function is to monitor the quality of service of our company clusters deployed in the field, and take the necessary actions in the case of service degradation or outage. The person that works in a SOC is a SOC Operator. This person will be looking at a dashboard of monitored items, and when green lights turn red, they will click on the red light, read a runbook, and endeavor to resolve the issue. If they can fix the problem in 30 mins, they will. If they can not fix the problem, they will declare an incident and page in Support who will begin troubleshooting, and begin keeping a timeline of events. If Support can't fix the problem, the SOC Operator will page in R&D. The SOC Operator will 'run' the incident until the issue is resolved. Once resolution occurs, the SOC operator close out ticket, and publish a Preliminary Findings Report in the ticket. All the while, the SOC Operator will provide a play-by-play in the internal slack channel to keep everyone aware of what's happening.
Job Description
Job Summary: As a SOC Operator, you will be responsible for monitoring and maintaining the health and performance of our fleet of installed clusters. You will work in a 24/7 operations environment, ensuring the availability, reliability, and security of services. This role involves real-time monitoring, incident detection, incident management, incident resolution, and clear written and verbal communication with other teams and stakeholders.
Responsibilities:
Monitor clusters using internal monitoring tools to detect and troubleshoot issues promptly.
Respond to alerts and incidents in a timely manner, following standard operating procedures (SOPs) and escalation processes.
Perform initial investigation and diagnosis of problems, escalating complex issues to support or R&D.
Document incidents, including their details, troubleshooting steps, and resolutions in the incident tracking system.
Collaborate with other teams, including Support, R&D, Account teams, and customers to ensure effective incident resolution and communication.
Conduct routine checks and audits to identify potential problems or vulnerabilities.
Assist with the implementation of changes and updates to the infrastructure as directed by team leads.
Participate in shift-based work schedules, including nights, weekends, and holidays, to provide 24/7 coverage in the SOC.
Maintain up-to-date knowledge of storage technologies, industry trends, and best practices.
Adhere to security protocols and ensure the confidentiality, integrity, and availability of network and system data.
Contribute to the development and improvement of SOC processes and procedures.
Provide excellent customer service to internal and external stakeholders during incident resolution and communication.
High school diploma or equivalent; a degree or certification in information technology or a related field is a plus.
Proven experience as a SOC Operator or in a similar network monitoring role is preferred.
Strong understanding of networking concepts, protocols, and technologies (TCP/IP, SNMP, DHCP, DNS, etc.).
Ability to work independently and collaboratively in a team-based environment.
Excellent problem-solving and analytical skills, with the ability to multitask effectively.
Good communication skills, both written and verbal, to interact with technical and non-technical stakeholders.
Willingness to work in a 24/7 shift-based environment, including nights, weekends, and holidays.
Detail-oriented and committed to maintaining accurate documentation.
Demonstrated commitment to continuous learning and self-improvement.

As a Senior SOC Engineer within Unit 42 at Palo Alto Networks, you will drive the creation, validation, and optimization of custom detection rules and automated playbooks across our global customer base. Acting as a trusted advisor, you will collaborate closely with clients to maximize their security posture using Cortex XSIAM and Unit 42 expertise. This highly analytical role leverages your deep understanding of detection lifecycles, proactive automation, and threat intelligence to secure enterprise environments. You will architect end-to-end security lifecycles that seamlessly connect data ingestion with high-fidelity detection engineering.
Key Responsibilities
Own the full lifecycle of custom detections and response automations, deploying them as high-fidelity Cortex XSIAM correlation rules and playbooks through a rigorous engineering process of development, testing, staging, and soft implementation.
Drive the continuous refinement of correlation rules to ensure strict standards for performance, accuracy, and operational relevance.
Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable, robust detection logic.
Champion proactive automation by engineering sophisticated playbooks to resolve emerging security challenges and optimize operational workflows ahead of demand.
Architect the end-to-end security lifecycle within Cortex XSIAM, seamlessly connecting data ingestion, high-fidelity detection engineering, and sophisticated response automation.

As a Senior SOC Engineer within Unit 42 at our company, you will drive the creation, validation, and optimization of custom detection rules and automated playbooks across our global customer base. Acting as a trusted advisor, you will collaborate closely with clients to maximize their security posture using Cortex XSIAM and Unit 42 expertise. This highly analytical role leverages your deep understanding of detection lifecycles, proactive automation, and threat intelligence to secure enterprise environments. You will architect end-to-end security lifecycles that seamlessly connect data ingestion with high-fidelity detection engineering.
Key Responsibilities
Own the full lifecycle of custom detections and response automations, deploying them as high-fidelity Cortex XSIAM correlation rules and playbooks through a rigorous engineering process of development, testing, staging, and soft implementation.
Drive the continuous refinement of correlation rules to ensure strict standards for performance, accuracy, and operational relevance.
Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable, robust detection logic.
Champion proactive automation by engineering sophisticated playbooks to resolve emerging security challenges and optimize operational workflows ahead of demand.
Architect the end-to-end security lifecycle within Cortex XSIAM, seamlessly connecting data ingestion, high-fidelity detection engineering, and sophisticated response automation.

If you are an innovator at heart and passionate about redefining how organizations secure modern environments end-to-end, we're looking for you.
We're looking for a Manager to lead a security research team for detection and response across cloud environments.
This is an opportunity to lead an exceptional group of researchers working on a startup-level product within the largest security company, helping revolutionize how organizations protect their Kubernetes and hybrid cloud environments.
Key Responsibilities
Manage a team of security researchers conducting research on attacks against cloud data , Kubernetes and containers.
Lead, mentor, and grow a team of talented security researchers focused on defending organizations as they transition from on-premises data centers to modern cloud and Kubernetes infrastructure.
Drive the strategy and execution of research initiatives to uncover novel techniques for detecting and responding to sophisticated attacks targeting hybrid and cloud-native environments.
Define and prioritize detection use cases, relevant datasets, and innovative analytic approaches combining runtime visibility and posture management across diverse platforms.
Stay up to date with the latest attacker methodologies, APT campaigns, and TTPs to ensure our detection capabilities stay ahead of evolving threats in both legacy and cloud contexts.
Oversee simulation of real-world attacks and deep behavioral analysis to inform and validate detection content.
Foster collaboration across engineering, product management, and go-to-market teams to deliver impactful security solutions.
Represent the team and share insights with the security community through blogs, conference talks, and publications.

What am I going to do?
Own complex Trust & Safety operational initiatives from definition through execution, rollout and measurement.
Lead operational aspects of new moderation technologies, external vendor integrations and tooling improvements, including solutions such as automated and AI-assisted moderation.
Act as the operational owner for integrations: define requirements, identify dependencies, coordinate Product, Engineering, Data, Policy, Legal and vendor stakeholders, manage timelines and drive decisions to closure.
Translate T&S problems and policy requirements into scalable operational workflows, enforcement logic, rules, tooling requirements and implementation plans.
Continuously identify operational gaps, inefficiencies and emerging abuse trends and proactively propose solutions rather than waiting for predefined projects.
Build and improve moderation workflows across automation and human review, balancing accuracy, operational efficiency, user impact and business needs.
Own relationships with relevant moderation and T&S vendors, including implementation, performance management, escalation and ongoing optimization.
Drive cross-functional projects involving Policy, Product, Engineering, Data Science, Legal, Customer Care, QA and Training.
Support incident and escalation management when operational or platform-integrity risks require rapid cross-functional response.
Help shape the longer-term operating model and capabilities of the Trust & Safety function.

at the company, what you do matters. every day, we protect over 100,000 organizations worldwide from increasingly sophisticated cyber and ai-driven threats, securing their ai transformation.
our prevention-first approach safeguards hybrid networks, cloud environments, digital workspaces, and ai systems, stopping attacks before they happen.
this is where innovation meets real-world impact. youll help customers across industries operate with confidence in a rapidly changing digital world, working alongside smart, curious people who take ownership, challenge assumptions, and solve complex problems.
were proud to be recognized by time, newsweek, and forbes for excellence and workplace culture.
what really sets the company apart is the opportunity to grow, contribute, and help companies navigate their ai transformation securely.
if youre excited to work at the forefront of ai-driven security on a global scale, this is the place to do it.
we are looking for future Professional Services consultants to join a unique career development program designed to prepare technical professionals for customer-facing consulting and delivery roles.
the program begins within our global Technical Support organization, where participants will receive structured technical training, product enablement, troubleshooting experience, and exposure to real customer environments.
following successful completion of the program, candidates will transition into Professional Services as associate and take ownership of customer implementations, migrations, optimization projects, and strategic security engagements.
this opportunity is designed for individuals who combine strong technical capabilities with excellent communication skills, customer-facing confidence, leadership potential, and the ability to independently drive complex technical initiatives from planning through successful delivery.
successful candidates will become trusted advisors to customers, helping design, implement, optimize, and deliver advanced cybersecurity solutions while working closely with customers, internal teams, and product experts.
participate in a structured tac-to-ps development program combining technical training, customer exposure, and hands-on experience.
develop deep expertise in the company products, security technologies, networking, and troubleshooting methodologies.
work directly with customers and internal teams to support technical investigations and problem resolution.
design, deploy, and maintain advanced cybersecurity solutions.
act as a trusted technical advisor and primary point of contact during customer engagements
lead technical workshops, architecture reviews, and customer-facing discussions.
identify technical risks proactively and drive resolution plans.
collaborate with tac, r&d, product management, sales, and project management teams to ensure successful delivery.
all your information will be kept confidential according to eeo guidelines.

we are looking for a MXDR Analyst to join the team of cybersecurity analysts monitoring services 24/7. The role includes development of detection analyses, triage of alerts, investigation of security incidents, proactive threat hunting and enhancement of sensors and overall visibility status.
The suitable candidate should be a team player with previous experience in SOC, SecOps or security monitoring, independent, and with a can-do attitude.
Responsibilities:
Working across all areas of Sygnias SOC, including continuous monitoring and analysis, threat hunting, security compliance, security event auditing and analysis, rule development and tuning, and forensics.
Solving security incidents in accordance with defined service level agreements and objectives.
Prioritizing and differentiating between potential incidents and false alarms.
Addressing clients enquiries via phone, email, and live chat.
Working side-by-side with customers, providing insightful incident reports.
Working closely with peers and higher-tier analysts to ensure that your analysis work meets quality standards.
Identifying opportunities for improvement and automation within the MXDR Operation Lead, and leading efforts to operationalize ideas.
Identifying and offering solutions to gaps in current capabilities, visibility, and security posture.
Correlating information from disparate sources to develop novel detection methods.

we are looking for an experienced Incident Responder to join our newly established team in Israel, and spread the power of our company!
Responsibilities
Investigate real-world cyber-attacks on customers cloud environments and cloud workloads, understanding their root causes and the full scope of compromise, leveraging the company platform.
Perform proactive threat hunting to identify undetected cyber-attacks and cloud threats within customer environments.
Collaborate with customer teams during engagements to effectively respond to threats.
Develop and deliver professional engagement reports, including high-level summaries and deep dives into technical findings.
Develop and document incident response methodologies, best practices, and standard operating procedures tailored to cloud environments and cloud workloads.
Collaborate with the threat research and engineering groups to refine and enhance incident response detections, tools, and features, based on real-world investigation experiences.