SecOps IR Analyst

Description:

At ONE ZERO, Israel’s first fully digital bank, we’re building secure and innovative financial products that redefine the banking experience.

We are looking for a hands-on SecOps IR Analyst with experience in security operations, incident investigation, and response. In this role, you will investigate and respond to threats across endpoints, identities, cloud environments, networks, and applications, taking ownership of incidents from detection through recovery and lessons learned.

You will work closely with security, IT, DevOps, and business teams to protect the bank and its customers, strengthen our detection capabilities, and improve response workflows through monitoring rules, automation, and security tooling.

·  Monitor, triage, and investigate security alerts across SIEM, EDR, SOAR, CNAPP, and other security platforms, distinguishing actionable threats from false positives.

·  Handle security incidents end to end: detection, investigation, scoping, containment, eradication, recovery, and lessons learned.

·  Correlate endpoint, identity, cloud, and network telemetry to establish incident timelines, identify root causes, and assess impact.

·  Investigate suspicious activity in AWS, Windows, macOS, and identity environments, including compromised accounts, persistence, lateral movement, and data exfiltration.

·  Write, tune, and maintain detection rules, correlation logic, and investigation queries to improve coverage and reduce false positives.

·  Build and maintain SOAR playbooks, scripts, and integrations to automate alert enrichment, investigation, and response.

·  Conduct proactive threat hunting and translate threat intelligence and investigation findings into actionable detections.

·  Produce clear incident reports, management updates, and response playbooks, documenting evidence, decisions, and follow-up actions.

·  Coordinate investigations and response activities with IT, DevOps, Fraud, Legal & Compliance, and external vendors.

·  Participate in an on-call rotation and support response to urgent security incidents.