Cybersecurity Analyst – Tier 1 (25531)

Who We Are:

Yael Group is a leading group of companies in the Israeli market, providing advanced technological solutions across a wide range of domains to organizations in all sectors.

Job Responsibilities:

• Ongoing monitoring and control of information security and cybersecurity systems.
• Identification, analysis, and investigation of cybersecurity alerts and incidents.
• Performing initial triage and assessing the severity of incidents.
• Performing initial response actions in accordance with procedures and Playbooks.
• Opening, documenting, managing, and escalating incidents.
• Ongoing work with SIEM, SOAR, EDR, and additional information security systems.
• Analyzing logs and events from communication systems, endpoints, servers, users, and organizational systems.
• Working according to procedures, SLA, and SOC workflows.
• Writing and updating procedures, Runbooks, and workflows.
• Identifying gaps in monitoring processes and raising recommendations for improvement.
• Collaborating with Tier 2, Tier 3, IR, Cyber Intelligence, Infrastructure teams, and additional technology stakeholders.
• Participating in incident investigations, lessons learned, and implementation of corrective actions.
• Assisting in improving the SOC's detection and monitoring capabilities.

Work Environment:

• Working in shifts as part of a 24/7 SOC operation.
• Working morning, evening, and night shifts, including weekends and holidays.
• Ability to handle multiple incidents and tasks simultaneously.
• Operational availability and flexibility according to the needs of the team and organization.
• Willingness to work irregular hours and during emergencies when required.
• Full responsibility for maintaining operational continuity during the shift and ensuring an orderly handover between shifts.

Mandatory Requirements:

• Cybersecurity course of at least 400 hours.
• At least 1 year of hands-on experience working with SIEM and SOAR systems.
• Familiarity with EDR, Firewall, Proxy, and WAF systems.
• Good understanding of communication protocols, including TCP/IP, DNS, and HTTP/HTTPS.
• Familiarity with Windows and Linux operating systems.
• Ability to read, analyze, and investigate logs and information security incidents.
• Basic understanding of Authentication, Active Directory, and identity processes.
• Good level of technical English.
• Ability and willingness to work 24/7 shifts, including nights, weekends, and holidays.

Advantages:

• Previous experience as a SOC Analyst.
• Experience with Splunk, Microsoft Sentinel, QRadar, or equivalent SIEM systems.
• Experience with Cortex XSOAR or equivalent SOAR systems.
• Experience with CrowdStrike or equivalent EDR systems.
• Experience investigating Phishing, Malware, Endpoint, Identity, and Network incidents.
• Familiarity with MITRE ATT&CK.
• Familiarity with Active Directory, Azure / Entra ID, and cloud environments.
• Familiarity with Threat Intelligence tools.
• Experience writing Queries, monitoring rules, or Use Cases.
• Professional certifications in cybersecurity and information security.