Security Automation Engineer jobs in Israel

Description At Sunbit, we're building financial technology that puts people first. By combining intelligent decisioning with a personalized, transparent approach, we help consumers access the payment options that are right for them while empowering merchants to build stronger customer relationships. Engineering is at the heart of how we make that happen. We build scalable distributed systems, cloud-native services, intelligent data platforms, and AI-powered solutions that enable real-time financial decisions at scale. By leveraging modern engineering practices and integrating AI into both our products and development workflows, we solve complex technical challenges, accelerate innovation, and continuously improve the way we build software. Every service, model, and architectural decision we make directly impacts our products, our customers, and the future of financial technology. About the Role We're hiring the first Security Automation Engineer for Sunbit's new Security Operations (SecOps) team, reporting directly to the SecOps Team Lead. SecOps is the single point of accountability for security operations at Sunbit. We run the pipelines that take an alert or finding from detection to verified closure, working with Engineering, IT, GRC, and application teams. We cover a broad security domain with a deliberately lean team, and that only works if the pipelines run themselves. Your job is to build that. You'll build the workflows and integrations that connect our security tools to each other, to Jira, and to Slack, so alerts arrive enriched, findings reach the right owner with context, and follow-up happens without anyone chasing it by hand. This is a hands-on engineering role: you'll build workflows and write code every week, and we expect you to use AI tools to move faster. We care more about what you've built than about years of experience. What You'll Do Security Automation & Integrations • Build and maintain automation workflows that connect our SIEM, EDR, cloud detection, vulnerability, and SaaS/data security tools via REST APIs and webhooks • Build scan-to-ticket pipelines, alert enrichment, and remediation routing that send each finding to the right team with full context • Add AI-assisted steps where they help, such as LLM-based alert summaries and context gathering, with a human in the loop where it matters • Automate SLA reminders, escalations, and status reporting so follow-up runs on its own • Keep automations and AI agents secure: least-privilege API access, secrets handling, and prompt-injection risk Detection & Response Operations • Triage security alerts across cloud, endpoint, and identity; classify them per our severity framework and escalate confirmed incidents • Turn every repeated triage step into an enrichment or auto-resolution playbook • Track false-positive rates and work with Engineering on detection tuning • Document incidents, maintain timelines, and keep runbooks and playbooks current Compliance Automation & Metrics • Automate recurring evidence collection for SOC 2 and PCI DSS • Build dashboards for time to respond, SLA compliance, false-positive rates, and automation coverage Requirements • Hands-on experience in security operations, IT, DevOps, or software engineering, or equivalent hands-on security projects (internship, labs, home lab, CTFs) • Security fundamentals: common threats, attack techniques, and controls, plus some hands-on alert triage or log investigation • Scripting ability: you can build a script that calls a REST API and handles authentication and errors, and you can read, test, and debug it • You've built at least one automation or integration for a security or operational workflow, with n8n, Tines, a SOAR, or your own scripts • You use AI coding tools and LLMs day to day • Basic understanding of cloud environments (AWS, GCP) • Comfortable with Jira (or similar) and clear written English for tickets, runbooks, and follow-ups Nice to Have • Workflow automation or SOAR platforms (n8n, Tines, Torq, Cortex XSOAR, Splunk SOAR) • Hands-on with SIEM, EDR, cloud security, or vulnerability tools, through their APIs and not just their consoles • Built LLM-powered workflows or AI agents (LLM APIs, MCP, AI nodes in n8n) • Interest in AI security: prompt injection, agent permissions, data leakage through LLMs • Git, Terraform, CI/CD, or detection-as-code (e.g., Sigma rules) • Building dashboards on operational or security data • Compliance automation in a regulated environment (SOC 2, PCI DSS) • Fintech experience • A GitHub repo or portfolio of things you've built Why This Role Is Different • Hire #1 on a new team, with real influence on how SecOps is built at Sunbit • Broad scope on a modern stack: detection and response, cloud security, vulnerability management, identity, data security, and compliance • Automation-first: your success is measured by how much manual work you eliminate, and you'll have real room to apply AI to security operations • Direct mentorship from the SecOps Team Lead, with a clear growth path as the team scales Recruitment Fraud Disclaimer We’ve been made aware of fraudsters impersonating Sunbit employees during the hiring process. Please note that all official communication will come from an @sunbit.com email address, through our applicant tracking platform @sunbit.comeet-notifications.com or directly via LinkedIn. We will never ask for your age, Social Security number, bank account details, payment of any kind, or other unrelated personal information during the application process. Our hiring process always includes interviews, either by phone, zoom, or in person, before any offer is made. If something feels suspicious, please contact us at HR to confirm. We ask that you contact HR only about potential instances of fraud. HR does not reach our recruiting team directly. Your application directly through the posting is the best way to ensure that your candidacy is reviewed by our team. Due to the volume of applications, we will not respond to nor forward emails about your candidacy that are sent to HR directly, and your email about your application will be deleted from our systems.

Description MER Group is looking for a Security Engineer with a developer mindset—someone who delivers results through code and automation rather than repetitive manual work. The organization operates a full Microsoft 365 E5 environment, a SIEM and SOC, a Fortinet security fabric, and a multi-site infrastructure spanning Israel and international locations. This position comes with a genuine mandate to deliver: authority to build, a dedicated training budget, a dedicated development environment, an organization-owned code repository, and access to approved enterprise AI tools. Key Responsibilities: • Maximize the end-to-end value of the Microsoft 365 E5 security stack across identity, endpoints, cloud, and email. • Build process automations using Microsoft Graph API, Logic Apps, and scripts, including employee lifecycle management, procurement and vendor approval, and request classification and routing. • Integrate large language models (LLMs) as system components for classification, document information extraction, and summarization. • Perform detection engineering: write and tune detection rules and reduce false positives. • Build automated response playbooks using a controlled, phased approach. • Lead the consolidation of overlapping tools and reduce licensing costs. • Define security requirements for new systems and implementations, including identity, logging, permissions, and API availability. Requirements Mandatory Requirements: • Experience: 4+ years in Security Engineering or Platform Engineering. • Environment: 2+ years of hands-on experience with Microsoft 365 and Entra ID. • Development: PowerShell and Python at a tool-building level—not one-off scripting. • Integration: Experience integrating at least three systems using REST APIs and Microsoft Graph. • Automation: Experience building multi-step workflows with error handling, idempotency, and logging. • Identity and Access: Strong knowledge of RBAC, least privilege, service accounts, and secrets management. • Working Practices: Experience with Git, version control, and written technical documentation. • Languages: Hebrew and technical English. Significant Advantages: • Experience with Microsoft Defender XDR or Microsoft Sentinel, including detection-rule and playbook development. • Experience integrating LLMs into production systems—not merely using chat-based tools. • Experience implementing DLP or cloud application controls. • Background in networking and Fortinet firewalls. • Relevant certifications: SC-200, SC-300, or AZ-500.

About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role We are looking for a skilled Lead Security Automation Engineer to join our SOC Automation team and play a key role in building and scaling automation across Security Operations. This is a hands-on role — you will design, develop, and integrate automation solutions across SIEM, EDR, and other security platforms, contributing to our SOAR capabilities from the ground up. You will work in a technologically rich environment, integrating with a wide range of security and infrastructure systems across the network — a unique opportunity to build automation at scale in a greenfield setting, with real influence over the architecture and tooling decisions. We are especially interested in candidates who are curious about leveraging AI and intelligent agents to help evolve next-generation automation and response workflows — and who want to be a driving voice in how we apply those technologies. Your responsibilities will include: Automation development • Design and develop automation workflows for incident response and SOC operations • Identify and eliminate manual processes through scalable automation • Build reusable components and maintainable automation patterns Engineering & integration • Develop integrations using REST APIs, webhooks, and event-driven architectures • Write high-quality, maintainable Python for automation and orchestration • Implement data parsing, enrichment, and transformation across multiple systems SOAR & platform buildout • Lead or actively contribute to the evaluation, selection, and implementation of SOAR/automation platforms • Design the automation architecture and integration strategy for the team • Build automation capabilities in a greenfield environment — your decisions will shape the foundation SOC collaboration • Work closely with SOC analysts and incident responders to translate operational needs into automation solutions • Improve end-to-end detection and response workflows through close partnership with the team AI & innovation • Actively build and evaluate AI/LLM and agent-based workflows applied to security automation • Prototype AI-assisted enrichment, triage, and response solutions and drive them toward production We expect you to have: • Minimum 3 years of hands-on experience with SOAR platforms (e.g., Torq, Cortex XSOAR, Splunk SOAR, or similar) • Strong hands-on experience with Python (or a comparable language) • Experience designing or implementing automation frameworks or workflows • Experience building integrations using REST APIs and web services • Experience working with security tools such as SIEM, EDR/XDR, or ticketing systems • Experience with at least one cloud platform (Azure, AWS, or GCP) • Solid understanding of incident response processes and SOC alert-handling workflows • Experience with at least one SIEM platform (Splunk,Sentinel,Qradar,Crowdstrike) It will be an added bonus if you have: • Experience with CI/CD pipelines and DevOps practices • Familiarity with cloud-native services and architecture • Hands-on exposure to AI/ML, LLMs, or agent-based systems • Has a strong hands-on engineering mindset — you build, not just advise • Is proactive, solution-oriented, and detail-focused • Is genuinely curious about AI and intelligent agents, not just aware of them • Collaborates well with both technical and operational teammates Benefits & Perks: • Competitive compensation • Career growth and learning opportunities • Flexibility and ownership • Collaborative and innovative culture • Opportunity to work on impactful AI projects • International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.