SecOps IR Analyst

ONE ZERO BANK

. Monitor, triage, and investigate security alerts across SIEM, EDR, SOAR, CNAPP, and other security platforms.

Posted 11/11/2026full-timeTel Aviv-Yafo • IsraelJuniorMid-LevelWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Incident Response and Threat Hunting, with a strong focus on security alert monitoring, investigation, and automation. Proficient in utilizing EDR, SIEM, and SOAR platforms to enhance security posture and incident handling capabilities.

Highest-signal resume keywords

Incident ResponseThreat HuntingEDR ExperienceSIEM ProficiencySecurity Automation

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident HandlingInvestigation QueriesDetection RulesForensic AnalysisAWS SecurityScripting in PythonTCP/IP AnalysisMITRE ATT&CK FamiliarityCustom IOAsMalware Analysis

Soft Skills

Analytical SkillsCommunication SkillsJudgment Under PressureOwnershipIndependent Investigation

Tools & Technologies

CrowdStrike FalconSplunkCortex XSOARCloudTrailKubernetesCNAPP PlatformsSASE/ProxyWAFDLPNDR

Industry Keywords

Financial EnvironmentFraud MonitoringAccount TakeoverPayment FraudIdentity-Based Attacks

Tech Stack

Tools & technologies

AWSCloudDNSKubernetesLinuxMacOSPythonSplunkSQLTCP/IP

About the role

Key responsibilities & impact

Monitor, triage, and investigate security alerts across SIEM, EDR, SOAR, CNAPP, and other security platforms.
Handle security incidents end to end, including detection, investigation, scoping, containment, eradication, recovery, and lessons learned.
Correlate endpoint, identity, cloud, and network telemetry to establish incident timelines, identify root causes, and assess impact.
Investigate suspicious activity in AWS, Windows, macOS, and identity environments, including compromised accounts, persistence, lateral movement, and data exfiltration.
Write, tune, and maintain detection rules, correlation logic, and investigation queries.
Build and maintain SOAR playbooks, scripts, and integrations to automate alert enrichment, investigation, and response.
Conduct proactive threat hunting and translate threat intelligence and investigation findings into actionable detections.
Produce incident reports, management updates, and response playbooks documenting evidence, decisions, and follow-up actions.
Coordinate investigations and response activities with IT, DevOps, Fraud, Legal & Compliance, and external vendors.
Participate in an on-call rotation and support urgent security incidents.

Requirements

What you’ll need

2+ years of hands-on experience in Incident Response, SOC Tier 2/3, or Threat Hunting, including end-to-end incident handling.
Hands-on investigation experience with EDR, SIEM, and SOAR platforms, such as CrowdStrike Falcon, Splunk, and Cortex XSOAR.
Ability to write complex investigation and correlation queries using languages such as SPL, CrowdStrike Query Language (CQL), SQL, or equivalent.
Experience writing and tuning monitoring and detection rules, and developing security automations through scripts, playbooks, or integrations.
Investigation and forensic analysis skills on Windows and macOS, including process activity, persistence mechanisms, forensic artifacts, and system logs.
Experience investigating AWS security incidents using CloudTrail, IAM activity, and GuardDuty findings; familiarity with Kubernetes and container environments.
Familiarity with CNAPP platforms and their cloud posture management and workload protection capabilities.
Understanding of identity-based attacks and environments such as Entra ID, including SSO and federation, SAML, OAuth/OIDC, MFA abuse, session hijacking, token theft, and account takeover.
Good knowledge of TCP/IP, DNS, HTTP/S, and TLS, with the ability to analyze firewall, SASE/proxy, WAF, and web server logs.
Familiarity with MITRE ATT&CK and incident response practices.
Scripting skills in Python, PowerShell, Bash, or a similar language.
Strong analytical skills and the ability to investigate independently, support conclusions with evidence, and distinguish noise from real incidents.
Excellent written and verbal communication skills, including the ability to explain technical findings to both technical teams and management.
Strong ownership, sound judgment under pressure, and willingness to participate in an on-call rotation.
High proficiency in English, including reading, writing, and speaking.
Experience in a financial or banking environment, including fraud monitoring, prevention, or investigations involving account takeover (ATO) and payment fraud (advantage).
Advanced Detection Engineering experience, including Custom IOAs, Sigma rules, SIEM detections, detection coverage analysis, and SOAR playbook development (advantage).
Experience turning threat intelligence and indicators of compromise (IOCs) into hunting queries, and investigating attacker infrastructure through IP addresses, ASNs, and domains (advantage).
Experience investigating attacks against web applications and APIs, including injection, authentication bypass, and business-logic abuse (advantage).
Understanding of enterprise security risks associated with AI tools and AI agents, including data leakage, excessive permissions, and DLP controls (advantage).
Experience with basic malware analysis, including static and dynamic analysis (advantage).
Experience with Purple Team exercises or attack simulations to validate detection and response capabilities (advantage).
Familiarity with Linux investigations and additional security platforms such as NDR, email security, and DLP (advantage).