Security Operations Analyst, Detection & Response

About Aidoc

Aidoc is revolutionizing clinical decision-making with real-time clinical AI imaging solutions, impacting over 60 million patients annually.

Our technology empowers physicians to diagnose urgent cases, ultimately improving patient outcomes. Powered by our proprietary aiOS, Aidoc assists clinicians by precisely highlighting suspected pathological findings directly on medical images and prioritizing cases. This ensures that urgent patients receive the immediate attention they need.

As a leader in clinical AI, Aidoc has the most FDA-cleared Computer-Aided Detection (CAD) solutions, with adoption in more than 1,600 medical centers worldwide. Since our founding in 2016, Aidoc has secured over $500 million in funding and was recognized as one of TIME’s 50 most genius companies.

About This Role

As a Security Operations Analyst, Detection & Response, you will help protect Aidoc’s cloud environments, products, corporate systems, and sensitive healthcare data by investigating SIEM alerts, supporting incident response, and improving the quality of security monitoring.

This is a hands-on security operations role for someone who can analyze security signals, understand real risk, communicate clearly, and help the organization respond quickly and effectively to security events.

You will work closely with real production environments, where accurate investigation, clear documentation, and practical escalation are critical to protecting sensitive healthcare data, customer trust, and the reliability of Aidoc’s clinical AI platform.

Responsibilities

• Own the end-to-end investigation of SIEM alerts across cloud, product, identity, endpoint, and SaaS environments: analyze the relevant evidence, separate false positives from real threats, and prioritize cases based on risk and impact.
• Escalate high-risk findings with a clear summary of what happened, what is affected, why it matters, and what actions are required.
• Support incident response by collecting evidence, assisting with containment, tracking remediation, and maintaining clear investigation records for internal reviews, compliance needs, and post-incident learning.
• Improve SIEM rules, dashboards, alert logic, playbooks, telemetry coverage, and detection quality to reduce noise and strengthen security monitoring.
• Work with Security, IT, DevOps, R&D, Product Security, and Compliance teams to resolve issues and improve security operations.
  
  

• 2+ years of experience in Security Operations, SOC analysis, detection and response, incident response, cloud security operations, or a similar hands-on security role.
• Hands-on experience with SIEM-based investigations, including alert triage, log analysis, event correlation, evidence review, case prioritization, and escalation.
• Experience working with security telemetry from cloud platforms, identity providers, endpoints, SaaS systems, network tools, application logs, and production environments.
• Familiarity with cloud-native environments, including IAM, storage access, workloads, Kubernetes, containers, APIs, logging, monitoring, and CI/CD pipelines.
• Understanding of common attack techniques, including credential compromise, phishing, privilege escalation, suspicious API activity, malware, data exposure, lateral movement, and cloud misconfigurations.
• Experience with identity and endpoint investigation, including SSO, MFA, service accounts, privileged access, EDR alerts, and suspicious user or device activity.
• Ability to use query or scripting languages such as KQL, SPL, SQL, Python, Bash, or similar.
• Familiarity with incident response workflows, case management, evidence collection, remediation tracking, and post-incident review.
• Strong analytical judgment, with the ability to separate false positives from real risk and explain findings clearly.
• Ability to work independently, document investigations clearly, and escalate issues with the right level of urgency.
• Strong communication skills and the ability to work with Security, IT, DevOps, R&D, Product Security, Compliance, and business stakeholders.
• Close attention to detail, strong ownership, and comfort working in a fast-moving production environment.
  
  

• Experience in healthcare, healthtech, medical devices, digital health, or regulated software environments.
• Familiarity with HIPAA, GDPR, SOC 2, ISO 27001, NIST CSF, or similar security and privacy frameworks.
• Familiarity with MITRE ATT&CK, detection logic, attacker behavior, and investigation playbooks.
• Experience with threat hunting, detection engineering, malware analysis, forensics, or advanced incident response.
• Experience with SOAR platforms, case management systems, threat intelligence feeds, detection-as-code, or SOC automation.
• Experience improving SOC metrics such as alert noise, false-positive rate, time to triage, time to escalation, and investigation quality.
• Experience working with sensitive data, PHI/PII, customer-facing environments, or audit-ready evidence collection.
  
  

• Be part of something big - using cutting-edge technologies to transform the Healthcare industry (while saving patients’ lives)
• We work in a hybrid model, with our new offices located at 34 HaMasger Street in Tel Aviv and parking for employees.
• Amazing and healthy breakfasts and lunches prepared daily by our personal chef!
• Stocked up kitchen & meal card
• Wellness: Aidoc employees-only gym, plus Pilates, Yoga, and functional workouts classes.
• Amazing culture - collaborative, transparent & fun!
• Attractive compensation package & benefits