Incident Responder jobs in Israel

Description Sygnia is the foremost global cyber readiness and response team, applying creative approaches and battle-tested solutions to help organizations beat attackers and stay secure. With a team of deep digital combat, leading- edge, purpose-built technology, and enterprise security specialists, it enables companies to proactively build cyber resilience and defeat attacks within their networks. Sygnia is a trusted advisor and service provider of technology and security teams, executives and boards of leading organizations worldwide. Sygnia supports clients at each stage of their security journey, bringing frontline experience and technological acumen to help them be unstoppable in the face of cyber threats. The company draws on top talent from the ranks of elite military technology units and from across the cyber industry and has some of the world’s top talents in cyber security. Described by Forbes as a “cyber security delta force”, it applies technological supremacy, digital combat experience, data analytics and a business-driven mindset to cyber security, enabling organizations to excel in the age of cyber. Cyber threats are constantly growing in volume, velocity and sophistication. When an organization is confronted with an advanced attack, it needs the strongest capabilities on its side. In many cases, an incident response engagement is in fact a battle within a network. The operational art, experience focus and speed of Sygnia response teams can mean the difference between a minor blow and a devastating impact on performance and reputation of organizations. Sygnia is looking for highly capable Incident Response Expert. The Incident Response Expert role includes conducting in-depth forensic analysis, investigation and response to real-world cyber threats. A significant part of our investigations is performed onsite at the client location, in collaboration with the client’s IT and security teams. Main Responsibilities • Participate in forensic and incident response investigations, including large scale sophisticated attacks, conduct log analysis, host and network-based forensics and malware analysis. • Participate in threat hunting: proactively hunt for targeted attacks and new emerging threats in client’s networks; as well as security assessments and simulations. • Identify indicators of compromise (IOCs) and tools, tactics, and procedures (TTPs) to help ascertain whether and how breaches have occurred. • Utilize and develop tools and methodologies to improve Sygnia’s existing investigative and hunting technological stack. • Collaborate with IT and Security teams during investigations. • Generate and present a comprehensive and professional report of findings from investigations. Requirements Main Requirements: • At least 3 years of a relevant experience (from military service and/or industry). • Bright, curious and determined team player, who strive for excellency. • Problem solver, in-depth thinker with growth mindset. • Demonstrated in-depth understanding of the life cycle of advanced security threats, attack vectors and variant methods of exploration. • Deep technical understanding of network fundamentals and common Internet protocols. • Solid understanding of system and security controls on at least two OSs (Windows, Linux / Unix and MacOS), including host-based forensics and experience with analyzing OS artifacts. • Fluency with one or more scripting language (i.e. Python). • Multidisciplinary knowledge and competencies, such as: • Hands-on experience in data analysis (preferably network traffic or log analysis) in relevant data analysis and data science platforms (Jupyter, Splunk, pandas, SQL). • Familiarity with cloud infrastructure, web application and servers, android and iOS mobile platforms. • Experience with malware analysis and reverse engineering. • Familiarity with enterprise SIEM platforms (e.g. Splunk, QR.adar, ArcSight). • Excellent communication and interpersonal skills. Fluent English, including the ability to document and explain technical information in a concise, understandable manner.

Description Sygnia is the foremost global cyber readiness and response team, applying creative approaches and battle-tested solutions to help organizations beat attackers and stay secure. With a team of deep digital combat, leading- edge, purpose-built technology, and enterprise security specialists, it enables companies to proactively build cyber resilience and defeat attacks within their networks. Sygnia is a trusted advisor and service provider of technology and security teams, executives and boards of leading organizations worldwide. Sygnia supports clients at each stage of their security journey, bringing frontline experience and technological acumen to help them be unstoppable in the face of cyber threats. The company draws on top talent from the ranks of elite military technology units and from across the cyber industry and has some of the world’s top talents in cyber security. Described by Forbes as a “cyber security delta force”, it applies technological supremacy, digital combat experience, data analytics and a business-driven mindset to cyber security, enabling organizations to excel in the age of cyber. Sygnia is looking for an experienced Incident Response Team Leader (IR TL) to lead incident response investigations and security assessment projects for clients worldwide. This is a leadership role within Sygnia’s Incident Response department and an integral part of the company’s global IR service delivery organization. The role combines hands-on technical leadership, team management, client engagement and project leadership. The IR TL will lead and mentor highly skilled cyber security researchers and forensic experts while managing complex investigations and helping clients respond to sophisticated cyber threats. Following a substantial and successful tenure in the position, the IR TL will have opportunities for continued professional growth and advancement across a variety of technical, managerial and client-facing roles within Sygnia. Main Responsibilities • Lead a team of top-tier cyber security researchers and forensic experts conducting assessments and in-depth analysis in complex investigations, as well as security assessments. • Guide and empower team members, enhancing their technical and research skills. • Lead client-facing projects including incident response and hunting efforts for large-scale sophisticated attacks, to contain and defeat real-world cyber threats. • Collaborate and work with clients’ IT and Security teams during investigations. • Design and improve internal incident response technologies, methodologies, and processes. Requirements Main Requirements • At least 3 years of senior-level experience leading or conducting incident response investigations and research in a professional cybersecurity environment, within the civilian sector. • Experience conducting incident response investigations and research in a professional cybersecurity environment, including direct client-facing experience, preferably within the civilian sector. • Excellent English – spoken and written. • In-depth understanding of the lifecycle of advanced security threats, attack vectors and methods of exploitation. • Strong technical understanding of network fundamentals, common internet protocols and system and security controls. • Experience with the tools and techniques used in security event analysis, incident response, computer forensics, malware analysis, or other areas of security operations. • Multidisciplinary knowledge and competencies, such as: • Hands-on experience in data analysis, preferably network traffic or log analysis, using relevant data analysis and data science platforms such as Jupyter, Splunk, pandas and SQL. • Familiarity with cloud infrastructure, web applications and servers, and Android and iOS mobile platforms. • Experience with malware analysis and reverse engineering. • Familiarity with enterprise SIEM platforms, such as Splunk, QRadar and ArcSight. • Exceptional reporting and analytics abilities, as well as strong written and oral presentation skills. The ability to articulate complex technical issues in a concise and confident manner and provide status updates to a variety of audiences, including technical personnel and executive-level management. • Ability to work in a dynamic matrix organizational structure, with people across all levels of the company, including executives and technical stakeholders. • Team-oriented, with excellent communication skills. • Decisive, bright and positive leader who strives for excellence. • Previous experience in strategy or cybersecurity consulting – an advantage. • Willingness to travel abroad as required. • Willingness to work irregular hours, including evenings, nights, weekends and holidays, as required by incident response engagements.

Description Sygnia is the foremost global cyber readiness and response team, applying creative approaches and battle-tested solutions to help organizations beat attackers and stay secure. With a team of deep digital combat, leading- edge, purpose-built technology, and enterprise security specialists, it enables companies to proactively build cyber resilience and defeat attacks within their networks. Sygnia is a trusted advisor and service provider of technology and security teams, executives and boards of leading organizations worldwide. Sygnia supports clients at each stage of their security journey, bringing frontline experience and technological acumen to help them be unstoppable in the face of cyber threats. The company draws on top talent from the ranks of elite military technology units and from across the cyber industry and has some of the world’s top talents in cyber security. Described by Forbes as a “cyber security delta force”, it applies technological supremacy, digital combat experience, data analytics and a business-driven mindset to cyber security, enabling organizations to excel in the age of cyber. Sygnia is looking for an experienced Incident Response Manager (IRM) to lead incident response services for clients across EMEA. This is a senior management role within Sygnia’s Incident Response department and an integral part of the company’s global IR service delivery organization. The role combines technical leadership, crisis management, client engagement, and cross-functional project leadership. Following a substantial and successful tenure in the position, the IRM will have opportunities for continued professional growth and advancement across a variety of roles within Sygnia. Main Responsibilities • Lead incident response and threat-hunting engagements involving large-scale and sophisticated cyberattacks, with the objective of containing, mitigating, and defeating real-world threats. • Lead dynamic, cross-functional teams of cybersecurity researchers, forensic experts, and other specialists assembled according to the specific needs of each engagement. Team members do not report directly to the IRM outside the scope of the project. • Maintain clear, concise, and timely internal communication, providing regular updates to technical, financial, legal, business, and executive stakeholders within Sygnia. • Lead client-facing communication throughout investigations and work closely with clients’ IT, security, legal, and executive teams, as well as relevant external stakeholders. • Serve as a trusted advisor to clients during high-pressure and business-critical situations. • Collaborate with Sygnia’s global teams to ensure consistent, high-quality incident response delivery across regions. • Strengthen client relationships, identify relevant business opportunities, and support the introduction of additional Sygnia services. • Contribute to Sygnia’s broader strategic objectives through professional publications, thought leadership, marketing initiatives, and business development activities. • Design, develop, and continuously improve internal incident response methodologies, processes, and capabilities. Requirements Main Requirements • At least 5 years of experience leading teams through direct management, project-based leadership, matrix management, or a combination of these models. • Proven ability to lead diverse groups of specialists who do not report directly to the role, while maintaining alignment, accountability, and effective execution. • A decisive, intellectually sharp, and positive leader with a strong commitment to excellence. • Calm and thoughtful leadership style, with the ability to make sound decisions in highly dynamic and fast-paced environments. • Strong crisis-management capabilities, including the ability to objectively assess situations, manage complex stakeholder relationships, and continuously evaluate actions and priorities. • Exceptional written, verbal, and presentation skills in English, with the ability to explain complex technical matters clearly and confidently to both technical professionals and executive leadership. Additional languages are an advantage. • In-depth understanding of advanced cyber threats, attack vectors, adversary techniques, and exploitation methods. • Strong technical knowledge of network fundamentals, common internet protocols, operating systems, and security controls. • Familiarity with the tools and techniques used in security event analysis, incident response, digital forensics, malware analysis, and broader security operations. • Ability to work in a project-based model involving urgent and unplanned engagements, including availability outside regular working hours and on weekends when required. • Willingness to travel internationally as needed. • Previous experience in strategy or cybersecurity consulting is an advantage. • An academic degree in a technological or scientific discipline is an advantage.

Come join the organization that is redefining security for the AI era. As one of the fastest-growing startups ever, we enable teams to secure cloud and AI applications by connecting code, cloud, and runtime into a single shared context. Trusted by security teams all over the world, we have a proven track record of success and a culture that values world-class talent. Not to mention, we're now powered by Google, meaning we offer our customers an AI-powered platform that harnesses Google’s Threat Intelligence and Security Operations to better detect, prevent, and respond to threats across all environments, allowing for further innovation. Our Wizards from all over the globe work together to protect the infrastructure of our customers, including over 65% of the Fortune 100, who trust us to scan and secure over 230 billion files daily. We’re honored to be a leading player in a massive and growing market, and we continue to look for exceptional Wizards who are eager to make a significant impact on our team. At Wiz, you’ll have the freedom to think creatively, dream big, and use your full range of skills to contribute to our momentous growth. Come join our team and help us create secure cloud environments that allow even the best companies to move faster, all while having some fun! Minimum Qualifications • 5 years of experience in cybersecurity, cyber-incident response, and threat hunting. • Experience with cloud security, including cloud services, Kubernetes, cloud architecture, and major cloud providers (AWS, GCP, Azure). • In-depth knowledge of OS internals for both Windows and Linux. • Experience with scripting languages and querying languages. • Full professional fluency (written and verbal) in both Hebrew and English. Preferred Qualifications • Strong analytical skills with a keen attention to detail. • Passion to solve any problem and to thrive as an independent and innovative Incident Responder. About the job Wiz is looking for an experienced Incident Responder to join our newly established team in Israel, and spread the power of Wiz! Responsibilities • Investigate real-world cyber-attacks on customers’ cloud environments and cloud workloads, understanding their root causes and the full scope of compromise, leveraging the Wiz platform. • Perform proactive threat hunting to identify undetected cyber-attacks and cloud threats within customer environments. • Collaborate with customer teams during engagements to effectively respond to threats. • Develop and deliver professional engagement reports, including high-level summaries and deep dives into technical findings. • Develop and document incident response methodologies, best practices, and standard operating procedures tailored to cloud environments and cloud workloads. • Collaborate with the threat research and engineering groups to refine and enhance incident response detections, tools, and features, based on real-world investigation experiences. Applicants must have the legal right to work in the country where the position is based, without the need for visa sponsorship. This role does not offer visa sponsorship. Wiz is an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. By submitting your application, you acknowledge that Wiz will process your personal data in accordance with Wiz's Privacy Policy.

About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a deeply technical DFIR Expert for its Digital Forensics and Incident Response (DFIR) team, working alongside the Security Operations Center (SOC). This role is a senior hands-on responder position, executing containment, eradication, and recovery on declared incidents and conducting the forensic investigations behind them, upholding the standards the DFIR team operates by. This role reports to the DFIR Lead, under the Detection and Response function within the CISO Office. Your responsibilities will include: • Execute the technical response to major incidents from escalation through to recovery, in partnership with and under the direction of the DFIR Lead. • Conduct end-to-end forensic investigations across cloud, platform, and endpoint environments. • Handle evidence to a standard that meets legal, regulatory, and forensic requirements, including chain- of-custody discipline. • Receive incident handoffs from the SOC and lead the response while the SOC continues to support the investigation. • Produce post-incident deliverables: technical reports, root cause analyses (RCA), and regulatory-ready documentation. • Contribute to DFIR runbooks, tooling selection and maturation, and readiness exercises (tabletops and simulations). • Drive lessons-learned into measurable improvements in controls, detection fidelity, and response readiness together with the SOC, Security Engineering, and Threat Intelligence teams. • Raise the wider team's forensic capability through case walkthroughs and mentoring of SOC analysts, and participate in the DFIR on-call rotation, acting as the response point of contact outside business hours. We expect you to have: Experience • Around 5 years of hands-on digital forensics and incident response (DFIR) experience, including significant technical roles in large-scale, high-impact incidents (ransomware, advanced threat actors, cloud intrusions, identity compromise). • Experience responding to incidents in cloud or infrastructure-heavy environments. Technical Expertise • Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability. • Cloud and container forensics: acquiring and analyzing evidence from cloud control planes, Kubernetes workloads, and identity systems. • Fluency in attacker TTPs (MITRE ATT&CK), including the Cloud and Containers matrices. • Hands-on experience with EDR, SIEM, and forensic tooling such as Velociraptor, Volatility, and X-Ways or EnCase. • Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions. • Malware triage capability sufficient to characterize behavior, extract indicators, and inform containment decisions. • Certifications such as GCFE, GCFA, GNFA, GCFR, or GREM are an advantage. Leadership & Communication • Composed and decisive under incident pressure, with the ability to take clear response actions. • Rigorous about evidence and intellectually honest: findings are validated and assumptions are labeled. • Clear, concise communicator, able to brief technical peers and the DFIR Lead as readily as Legal, Privacy, and executive stakeholders. • A genuine partner to the SOC, sharing context freely and respecting the investigation that came before the handoff. • Fluent in English, written and verbal, comfortable working with international teams and stakeholders. Benefits & Perks: • Competitive compensation • Career growth and learning opportunities • Flexibility and ownership • Collaborative and innovative culture • Opportunity to work on impactful AI projects • International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a deeply technical DFIR Lead to build and lead the company’s global incident response capability - its people, tooling, and methodology - while remaining the hands-on technical authority on the hardest investigations. Reporting to the SOC Manager, the DFIR Lead will recruit, grow and direct a team of DFIR Experts, owning response execution, chain of custody and quality across Nebius’ cloud, infrastructure, and platform environments. This is a hands-on role that balances deep technical work along with building and running the function: the Lead drives high-severity incidents end-to-end, serves as the escalation ceiling, and sets the standards and structure the team operates by. You’re welcome to work in our offices in Tel Aviv, Israel. Your responsibilities will include: • Build and lead Nebius’ global DFIR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders. • Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases. • Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction. • Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements. • Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR. • Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA). • Raise the team’s technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness. We expect you to have: Experience • 7+ years of hands-on incident response and digital forensics, including technical leadership of large-scale, high-impact incidents (ransomware, nation-state / advanced threat actors, cloud intrusions, identity compromise). • Experience building or leading IR teams and capabilities in cloud or infrastructure-heavy environments, which are highly regulated (SOC 2, ISO 27001, GDPR/NIS2). Technical Expertise • Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability. • Strong cloud-native platform security: containers and Kubernetes, CI/CD, secrets management, cloud control planes, and IAM attack paths. • Fluency in attacker TTPs (MITRE ATT&CK, including the Cloud and Containers matrices), and hands-on experience with EDR, SIEM, and forensic tooling (e.g., Velociraptor, Volatility, X-Ways/EnCase). • Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions. Leadership & Communication • Proven ability to lead under pressure and make high-quality decisions with incomplete data; technical leadership through credibility across regions, without relying on direct authority. • Clear, concise communicator capable of briefing executives, Legal, Privacy, and non-technical stakeholders. • Working knowledge of spoken and written English Benefits & Perks: • Competitive compensation • Career growth and learning opportunities • Flexibility and ownership • Collaborative and innovative culture • Opportunity to work on impactful AI projects • International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Job Description We are seeking an experienced Incident Response Global Manager based in Israel to lead and coordinate cyber incident response operations across multiple regions. This role is responsible for managing high-impact security incidents, overseeing global IR delivery, and ensuring seamless collaboration across a follow-the-sun model. The ideal candidate will combine strong technical expertise with leadership and stakeholder management skills. Major Responsibilities • Lead and manage end-to-end incident response engagements for global clients • Coordinate cross-regional IR teams to ensure 24/7 coverage and effective escalation • Act as the primary point of contact for customers during critical incidents • Oversee incident investigations, containment, eradication, and recovery efforts • Develop and refine IR processes, playbooks, and best practices • Support proactive services such as readiness assessments and tabletop exercises • Provide executive-level reporting and post-incident analysis • Mentor and develop IR team members across regions Qualifications • 7+ years of experience in cybersecurity, with a strong focus on incident response • Proven experience managing complex, high-severity cyber incidents • Deep understanding of threat actors, attack techniques, and forensic methodologies • Experience leading global or distributed teams in a follow-the-sun model • Strong communication skills in English • Relevant certifications (e.g., GCFA, GCIH, CISSP, or similar) preferred