SecOps IR Analyst

At ONE ZERO, Israel’s first fully digital bank, we’re building secure and innovative financial products that redefine the banking experience.

We are looking for a hands-on SecOps IR Analyst with experience in security operations, incident investigation, and response. In this role, you will investigate and respond to threats across endpoints, identities, cloud environments, networks, and applications, taking ownership of incidents from detection through recovery and lessons learned.

You will work closely with security, IT, DevOps, and business teams to protect the bank and its customers, strengthen our detection capabilities, and improve response workflows through monitoring rules, automation, and security tooling.

·  Monitor, triage, and investigate security alerts across SIEM, EDR, SOAR, CNAPP, and other security platforms, distinguishing actionable threats from false positives.

·  Handle security incidents end to end: detection, investigation, scoping, containment, eradication, recovery, and lessons learned.

·  Correlate endpoint, identity, cloud, and network telemetry to establish incident timelines, identify root causes, and assess impact.

·  Investigate suspicious activity in AWS, Windows, macOS, and identity environments, including compromised accounts, persistence, lateral movement, and data exfiltration.

·  Write, tune, and maintain detection rules, correlation logic, and investigation queries to improve coverage and reduce false positives.

·  Build and maintain SOAR playbooks, scripts, and integrations to automate alert enrichment, investigation, and response.

·  Conduct proactive threat hunting and translate threat intelligence and investigation findings into actionable detections.

·  Produce clear incident reports, management updates, and response playbooks, documenting evidence, decisions, and follow-up actions.

·  Coordinate investigations and response activities with IT, DevOps, Fraud, Legal & Compliance, and external vendors.

·  Participate in an on-call rotation and support response to urgent security incidents.

·  2+ years of hands-on experience in Incident Response, SOC Tier 2/3, or Threat Hunting, including end-to-end incident handling.

·  Hands-on investigation experience with EDR, SIEM, and SOAR platforms, such as CrowdStrike Falcon, Splunk, and Cortex XSOAR.

·  Ability to write complex investigation and correlation queries using languages such as SPL, CrowdStrike Query Language (CQL), SQL, or equivalent.

·  Experience writing and tuning monitoring and detection rules, and developing security automations through scripts, playbooks, or integrations.

·  Investigation and forensic analysis skills on Windows and macOS, including process activity, persistence mechanisms, forensic artifacts, and system logs.

·  Experience investigating AWS security incidents, using sources such as CloudTrail, IAM activity, and GuardDuty findings; familiarity with Kubernetes and container environments.

·  Familiarity with CNAPP platforms and their cloud posture management and workload protection capabilities.

·  Understanding of identity-based attacks and environments such as Entra ID, including SSO and federation, SAML, OAuth/OIDC, MFA abuse, session hijacking, token theft, and account takeover.

·  Good knowledge of TCP/IP, DNS, HTTP/S, and TLS, with the ability to analyze firewall, SASE/proxy, WAF, and web server logs.

·  Familiarity with MITRE ATT&CK and incident response practices.

·  Scripting skills in Python, PowerShell, Bash, or a similar language.

·  Strong analytical skills and the ability to investigate independently, support conclusions with evidence, and distinguish noise from real incidents.

·  Excellent written and verbal communication skills, including the ability to explain technical findings to both technical teams and management.

·  Strong ownership, sound judgment under pressure, and willingness to participate in an on-call rotation.

·  High proficiency in English, including reading, writing, and speaking.

·  Experience in a financial or banking environment, including fraud monitoring, prevention, or investigations involving account takeover (ATO) and payment fraud.

·  Advanced Detection Engineering experience, including Custom IOAs, Sigma rules, SIEM detections, detection coverage analysis, and SOAR playbook development.

·  Experience turning threat intelligence and indicators of compromise (IOCs) into hunting queries, and investigating attacker infrastructure through IP addresses, ASNs, and domains.

·  Experience investigating attacks against web applications and APIs, including injection, authentication bypass, and business-logic abuse.

·  Understanding of enterprise security risks associated with AI tools and AI agents, including data leakage, excessive permissions, and DLP controls.

·  Experience with basic malware analysis, including static and dynamic analysis.

·  Experience with Purple Team exercises or attack simulations to validate detection and response capabilities.

·  Familiarity with Linux investigations and additional security platforms such as NDR, email security, and DLP.