Detection Engineer jobs in Israel

Description KELA’s Cyber Intelligence Center is responsible for collecting and analyzing data using a unique automated technology that scans a curated set of cybercrime sources, providing fully targeted and actionable intelligence. The Threat Intelligence Analyst will conduct research both independently and in collaboration with other team and department members to detect cybersecurity threats and produce analytical reports and other intelligence deliverables. The successful candidate possesses an intelligence or research background, experience in cybersecurity-related roles, and excellent written and verbal communication skills in English. Responsibilities: • Monitor the threat landscape to identify new trends, intelligence sources, threat actors, attack tools, and techniques, providing unique perspectives from both KELA and outsourced sources. • Conduct Open-Source, Deep, and Dark Web research, including collecting, analyzing, cross-referencing, and interpreting data from multiple sources. • Produce threat intelligence reports, in-depth research, and presentations. • Present your research in webinars and client-facing events. Requirements • 3+ years experience as a threat intelligence analyst in a corporate environment • Knowledge of cybercrime landscape, both financially-motivated threat actors and nation-state • Investigative and analytical problem-solving skills • Active interest and creative thinking in cybersecurity • Experience in writing reports for various types of audience in English • Excellent attention to details and ability to organize and prioritize work with little supervision • An ability to operate semi-autonomously to conduct collection, create solutions and support intelligence production

About this role: Cilium Tetragon is a flexible, Kubernetes-aware security tool, with real-time observability and enforcement. Leveraging the power of eBPF, Tetragon offers a low-overhead, in kernel solution that enhances security posture by monitoring system behaviors such as process executions, system call activities, and both network and file access events. Tetragon Threat Detection Engineers primarily focus on creating and maintaining Tetragon runtime security policies, based on the latest threat intelligence, vulnerability disclosures, and their own research. Policies can act either as a mitigation to known vulnerabilities or as monitoring and protection against unknown security issues. What you’ll do: • Develop and maintain Tetragon runtime security policies to ensure customers have good visibility of suspicious activity on their infrastructure and are protected against the latest emerging threats • Help design frameworks and architectures that allow customers to easily consume policies and understand their overall security posture • Monitor vulnerability disclosures (CVEs) and the latest threat intelligence to develop Tetragon runtime security policies • Work with software engineers at Isovalent and Cisco to improve and enhance the capabilities of Tetragon security policies • Interact with solution architects and customers as necessary to support and deploy Tetragon security policies in production • Publish content and give talks based on your work Minimum Qualifications: • 3+ years of experience in threat and/or vulnerability research • 3+ years of experience in developing security detections at scale, for use in a wide range of environments • 3+ years of experience working on Linux system security (e.g., capabilities, LSMs, etc.) • Good communication skills, both written and verbal Preferred Qualifications: • Experience with eBPF (extended Berkeley Packet Filter) and its applications in security. • Experience with the cloud-native ecosystem (containers, Kubernetes, etc.) and their Linux implementation (e.g., Linux cgroups, namespaces) Why Cisco? At Cisco, we’re revolutionizing how data and infrastructure connect and protect organizations in the AI era – and beyond. We’ve been innovating fearlessly for 40 years to create solutions that power how humans and technology work together across the physical and digital worlds. These solutions provide customers with unparalleled security, visibility, and insights across the entire digital footprint. Fueled by the depth and breadth of our technology, we experiment and create meaningful solutions. Add to that our worldwide network of doers and experts, and you’ll see that the opportunities to grow and build are limitless. We work as a team, collaborating with empathy to make really big things happen on a global scale. Because our solutions are everywhere, our impact is everywhere. We are Cisco, and our power starts with you.

Description Sygnia is the foremost global cyber readiness and response team, applying creative approaches and battle-tested solutions to help organizations beat attackers and stay secure. With a team of deep digital combat, leading-edge, purpose-built technology, and enterprise security specialists, it enables companies to proactively build cyber resilience and defeat attacks within their networks. Sygnia is a trusted advisor and service provider of technology and security teams, executives and boards of leading organizations worldwide. Sygnia supports clients at each stage of their security journey, bringing frontline experience and technological acumen to help them be unstoppable in the face of cyber threats. Learn more at Sygnia.co The company draws on top talent from the ranks of elite military technology units and from across the cyber industry, and has some of the world’s top talents in cyber security. Described by Forbes as a “cyber security delta force”, it applies technological supremacy, digital combat experience, data analytics and a business-driven mindset to cyber security, enabling organizations to excel in the age of cyber. The Detection Engineer is responsible for designing, validating, optimizing, and continuously improving Sygnia MDR detection content across multiple security domains. This role combines threat research, security analytics, data-driven decision making, and detection engineering to ensure high-fidelity threat detection while minimizing operational noise. The Detection Engineer serves as the bridge between MDR Operations, Product, Engineering, and Threat Research teams, transforming emerging threats, operational insights, and telemetry analysis into scalable and actionable detection capabilities. . Main Responsibilities: • Detection Engineering & Optimization: Design, develop, maintain, and continuously optimize high-fidelity detection logic across endpoint, identity, cloud, email, network, and other security domains, maximizing coverage while minimizing false positives. • Threat Research & Detection Coverage: Research emerging threats, vulnerabilities, and attacker TTPs, translating threat intelligence into actionable detections while identifying and closing gaps in MITRE ATT&CK and ATLAS coverage. • Detection Quality & Performance: Establish detection quality standards, define and monitor performance metrics (precision, false positive rates, alert volume, coverage, and stability), and continuously improve detection effectiveness. • Detection Testing & Validation: Develop testing methodologies, validation frameworks, and lab environments to evaluate detection logic through attack simulations, real-world scenarios, and repeatable testing procedures before production deployment. • Security Data Research & Analytics: Analyze security telemetry, identify data quality and visibility gaps, and collaborate with Product and Engineering teams to improve data collection, normalization, enrichment, and detection capabilities. • AI & Detection Innovation: Research, develop, and evaluate AI agents and AI-powered automation solutions for threat research, security investigations, detection engineering, and alert enrichment, ensuring measurable improvements in detection quality and operational efficiency. • Detection Troubleshooting & Continuous Improvement: Investigate noisy or ineffective detections, perform root cause analysis, refine detection logic, and leverage operational feedback to improve alert quality and reduce analyst workload. • Client-Specific Detection Development: Design and implement customized detection content based on client environments, security requirements, threat profiles, and available telemetry. • Operational Excellence & Strategic Development: Drive initiatives to reduce alert fatigue, accelerate detection tuning, improve analyst efficiency, expand security visibility, and contribute to the long-term detection engineering strategy. Requirements Main Requirements: • 3+ years of experience in Detection Engineering, Threat Hunting, Security Analytics, MDR, Security Research, or related cybersecurity roles. • Experience delivering security detections for products, including hands-on experience creating, implementing, and tuning detection rules in SIEM, XDR, or EDR platforms. • Experience working with large-scale security datasets and telemetry. • Experience with SQL, KQL, Python, or similar analytical tools. • Understanding of security monitoring, detection methodologies, and investigation workflows. • Strong understanding of attacker TTPs and the MITRE ATT&CK and ATLAS framework. • Experience developing AI agents or AI-powered automation solutions. • Strong analytical mindset with the ability to explore, understand, and derive insights from large-scale security datasets. • Experience working with security telemetry across multiple domains, including endpoint, identity, cloud, email, network security, OS internals, EDR, Active Directory, Office 365, Cloud technologies such as AWS, Microsoft Azure and GCP, Network protocols and security products, including experience with security of AI infrastructure and services. • Ability to assess data quality, identify telemetry gaps, and evaluate the feasibility and effectiveness of detection strategies. • Experience evaluating or onboarding new security data sources and telemetry. • Excellent written and verbal communication skills. • Passion for cybersecurity and continuous learning. • Lab building and attack simulation experience. • Threat Hunting experience, including hands-on IR experience – advantage. • Red Team or penetration testing background – advantage • Experience with Detection-as-Code methodologies, including Git-based workflows, version control, automated detection testing, and CI/CD pipelines – An advantage.

About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. Detection and Response The Detection and Response team is responsible for detection engineering, threat intelligence, and incident response across Nebius Cloud. Its goal is to improve and maintain Nebius's security monitoring capabilities, as well as to build and maintain an end-to-end Security Incident Response program - people, processes, and tools. The Role We're hiring a Detection & Response Engineer to build and run our D&R capability from the ground up. You'll work on detection engineering, threat intelligence, and incident response functions across Nebius Cloud. You'll be responsible for detection development, handling complex security incidents, forensics, and shaping the D&R strategy. What you’ll do • Detection development: maintain low false-positive and false-negative rates. Work closely with alerts consumers (20+ teams) to keep noise low and signal high, ensuring they can act quickly without missing genuine threats. • Architect and operate detection coverage across our cloud and bare-metal environments • Build and extend our internal D&R tools and pipelines - onboard new logs, build and automate response runbooks. • Integrate threat intelligence into detection logic and IR playbooks, tracking adversary TTPs relevant to Cloud infrastructure • Lead incident response end-to-end: scoping, containment, root cause analysis, post-incident reviews and controlling critical action items are closed to prevent future possible incidents. • Partner with Compliance and Engineering teams to detect real threats while meeting the needs of both engineers and regulators. • Define and report on D&R metrics: MTTD, MTTR, detection coverage, false positive rates, etc. • Build and maintain Security Incident Response program: people, processes, tools. • Build tools, runbooks, and on-call processes that scale as the company grows. What we look for • 6+ years in security operations, detection engineering, or incident response. • Deep hands-on experience with cloud-native environments (Kubernetes, Linux workloads, container-based infrastructure). • Strong detection engineering skills: writing and tuning rules/detections in SIEM platforms (e.g., Chronicle, Splunk, Elastic) and SQL. • Experience building or operating SOAR workflows and automating response at scale (ideally with Golang and Temporal). • Working knowledge of threat intelligence frameworks (MITRE ATT&CK, Pyramid of Pain, Kill Chain) and how to operationalize them in detections. • Solid IR fundamentals: memory forensics, log analysis, network traffic analysis, and post-incident reporting. • Stakeholder management: able to coordinate across engineers, compliance, legal, executives during active incident phase. Serve as the primary owner and driver for complex changes, as a result of incidents post-mortem. Nice to have • Experience with AI/ML and GPU clusters related threats. • Familiarity with eBPF-based detection or runtime security tooling (Falco, Tetragon). • Background in threat hunting. Why this role at Nebius • Build D&R at a company scaling from startup to global infrastructure provider in real time. • Ability to evolve our internal D&R platform into a new cloud security product, delivering novel security observability for a range of neocloud customers - from big tech to AI startups. • Work alongside world-class engineers on infrastructure that powers frontier AI. • Competitive compensation with equity upside in a Nasdaq-listed, high-growth company. • Flexible, remote-first culture. Hiring Process • Recruiter's chat (30mins) • Live-coding interview (60mins) to asses basic coding skills • Security interview (60mins) to asses domain expertise • Incident Response interview (90mins) to assess practical experience • Final interview to close the hiring process (45mins) #LI-CP1 Benefits & Perks: • Competitive compensation • Career growth and learning opportunities • Flexibility and ownership • Collaborative and innovative culture • Opportunity to work on impactful AI projects • International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is looking for a Lead Detection Engineer.This is an individual contributor role with full technical ownership. You'll set the direction for detection engineering: the standards, the tooling, the coverage strategy, and the automation that operationalizes it all. You'll work closely with SOC analysts and Platform Engineering to make detection a first-class engineering discipline. You’re welcome to work in our offices in Tel Aviv, Israel Your responsibilities will include: • Detection coverage strategy across endpoint, identity, cloud, and infrastructure — how it's measured, prioritized, and continuously improved. • Detection-as-Code pipeline: version control, testing, peer review, CI/CD, and deployment practices for all detection logic. • Architecture connecting detections to enrichment, triage, and automated response workflows. • Technical standards for how detections are designed, tested, documented, deployed, and retired. • Detection quality: fidelity metrics, false positive reduction, coverage measurement, and continuous validation loops. • Design and build high-fidelity behavioral detections across SIEM and EDR platforms. • Research emerging attacker techniques and translate threat intelligence into scalable, evasion-resistant detections. • Validate detections through threat simulations and continuous detection testing. • Partner with SOC analysts to close the feedback loop between detections and real investigations. • Define and track detection engineering metrics; communicate coverage posture and effectiveness to security leadership. • Make architectural decisions that scale as the team and organization grow. We expect you to have: • Minimum 3 years in detection engineering, security operations, or a hybrid offensive/defensive role — with demonstrated depth, not just breadth. • Experience owning or leading detection engineering work as a senior technical contributor • Strong understanding of attacker tradecraft and adversary behavior. • Hands-on experience with at least one enterprise SIEM and EDR platform — Splunk, Microsoft Sentinel, CrowdStrike, or equivalent. • Cloud security depth across Azure, AWS, or GCP. • Strong query development skills in SPL, KQL, Sigma, or similar. • Strong scripting skills (python, powershell etc) • Solid engineering practices: Git, CI/CD, code review, Detection-as-Code workflows. • Experience using MITRE ATT&CK to design, validate, and measure detection coverage   • Ability to make and defend technical decisions and establish standards others adopt. It will be an added bonus if you have: • Offensive security background or certifications. • Experience with threat hunting and detection validation frameworks. • Experience designing SOAR playbooks and automated response workflows. • Experience building AI-assisted detection, investigation, or triage workflows. Benefits & Perks: • Competitive compensation • Career growth and learning opportunities • Flexibility and ownership • Collaborative and innovative culture • Opportunity to work on impactful AI projects • International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.