IR Team Lead - Cyber Incident Response (Tier 3)
Posted 24 days ago · 0 applicants
Saving, applying or scoring takes a few seconds to set up your free account.
The role in plain words
- 3+ years of experience investigating Tier 3 cyber incidents
- Experience leading a technical team
- Hands-on experience creating and tuning EDR detection rules
- Experience working with an external SOC, including SLA management and quality assurance
- Experience with SIEM platforms (Microsoft Sentinel or Splunk) and writing KQL or SPL queries
Extracted from the job description · kept up to date automatically
Who this suits
Full job description
Original listing · kept for referenceJoin one of Israel's leading insurance companies as an IR Team Lead, leading the organization's Tier 3 Cyber Incident Response team. This is a strategic, hands-on role combining technical leadership, advanced cyber investigations, development of detection capabilities, and continuous innovation in Detection & Response.
What You'll Do
• Lead the Tier 3 IR team, manage priorities, and drive end-to-end cyber investigations, including Digital Forensics, Threat Hunting, and Incident Response.
• Develop and enhance EDR detection capabilities, improve playbooks, and translate Threat Intelligence and MITRE TTPs into effective detection controls.
• Manage the external SOC, lead Purple Team and Breach & Attack Simulation initiatives, evaluate new security technologies, and collaborate with IT, Infrastructure, Cloud, and Cyber teams.
Requirements
• 3+ years of experience investigating Tier 3 cyber incidents - Must
• Experience leading a technical team - Must
• Hands-on experience creating and tuning EDR detection rules - Must
• Experience working with an external SOC, including SLA management and quality assurance - Must
• Experience with SIEM platforms (Microsoft Sentinel or Splunk) and writing KQL or SPL queries - Must
• Strong understanding of AI technologies, the evolving cyber threat landscape, and Autonomous SOC concepts - Must
• Strong knowledge of IT infrastructure, Networking, Windows, Linux, Active Directory, and Microsoft Entra ID - Must
• Experience with MITRE ATT&CK, Red Team, Purple Team, Penetration Testing, or Breach & Attack Simulation - Significant Advantage
• Relevant certifications such as GCIH, GCFA, GCIA, OSCP, or CRTO - Significant Advantage
Questions about this role
- This listing did not state a salary. We only show pay when the employer publishes it.
- 3+ years of experience investigating Tier 3 cyber incidents, Experience leading a technical team, Hands-on experience creating and tuning EDR detection rules, Experience working with an external SOC, including SLA management and quality assurance, Experience with SIEM platforms (Microsoft Sentinel or Splunk) and writing KQL or SPL queries