Security researcher, Autonomous SOC

About the Role

Type: Full-time Location: Hybrid (Tel Aviv) Compensation: Competitive We’re looking for a Security Researcher to help define how AI can investigate and respond to security threats with analyst-level quality. In this role, you’ll work closely with AI engineers, product teams, security practitioners, and enterprise customers to turn real SOC expertise into autonomous investigation systems. This is not a traditional security role. You’ll design investigation logic, evaluate AI agent performance, build realistic security scenarios, and help shape how autonomous security operations work in practice. We’re especially interested in candidates with strong SOC, IR, or detection engineering backgrounds who want to apply that expertise to AI-native security workflows.

What You'll Do

• Build analyst-grade security investigations
• Design and develop automated, multi-step investigation workflows for traditional and emerging SOC use cases
• Translate real-world SOC and IR expertise into structured investigation logic that AI agents can execute consistently
• Research and codify best practices for alert triage, scoping, pivoting, and escalation
• Evaluate and improve AI investigator quality
• Design evaluation frameworks that measure how well AI agents perform real-world investigations
• Create training examples, benchmarks, and test scenarios that teach models to make high-quality analyst decisions across diverse environments
• Validate agent outputs for accuracy, completeness, and escalation judgment
• Partner with AI engineers to improve multi-step reasoning, tool use, and investigation quality
• Build and operate security research labs
• Operate and expand SOC simulation environments
• Execute controlled attack simulations to generate realistic telemetry for testing, evaluation, and demos
• Automate the creation of investigation scenarios that stress-test agent behavior
• Strengthen security and responsible AI practices
• Contribute to internal security processes, tooling, and compliance efforts
• Help define guardrails and review practices for autonomous security investigations

What You’ll Bring

• 3+ years of hands-on experience in SOC operations, threat detection or incident response
• Deep familiarity with enterprise security tools such as SIEM, SOAR, EDR/XDR, email security, identity platforms, and cloud security tooling
• Strong understanding of attacker behavior, investigation methodology, and frameworks such as MITRE ATT&CK
• Experience building runbooks, playbooks, detections, or repeatable investigation procedures
• Strong written and verbal communication skills, with the ability to work across security, engineering, product, and customer teams
• A builder mindset and a bias toward turning messy expert knowledge into practical systems

Nice to Have

• Experience with threat intelligence platforms, malware or sandbox analysis
• Comfort with investigation and hunting query languages
• Experience automating security workflows or building SOAR integrations
• Familiarity with AI systems, prompt design, model evaluation, or human-in-the-loop review workflows
• Relevant certifications such as GCIH, GCFA, or GCIA