Information Security Manager

IR Team Lead (Tier 3)

We're looking for an experienced Incident Response (IR) Team Lead to join a leading enterprise organization in Central Israel in a hybrid work model.

Please note: This is not a SOC Manager position. This role focuses on leading a Tier 3 Incident Response team responsible for cyber investigations, threat hunting, detection engineering, and response capabilities.

Responsibilities

• Lead and mentor the Tier 3 Incident Response team, including planning, prioritization, and execution.

• Build and enhance detection capabilities by developing and maintaining EDR detection rules and other security controls.

• Lead complex cyber investigations, including Incident Response, Digital Forensics, and Threat Hunting.

• Manage the organization's external SOC provider, including SLA, KPI, investigation quality, and service oversight.

• Drive continuous improvement of detection playbooks and response processes.

• Evaluate security technologies and lead POCs for new cyber defense capabilities.

• Ensure log readiness and visibility to support effective incident investigations.

• Monitor Threat Intelligence and translate MITRE ATT&CK TTPs into practical detection rules and security controls.

• Lead Purple Team exercises and Breach & Attack Simulation activities to validate and improve detection coverage.

• Work closely with Infrastructure, IT, Cloud, Cyber Intelligence, BCP, and executive stakeholders.

Requirements

• 3+ years of hands-on Tier 3 Incident Response experience.

• Proven experience leading a technical cybersecurity team.

• Strong experience developing and tuning EDR detection rules.

• Experience working with or managing an external SOC provider.

• Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk) and KQL/SPL.

• Strong understanding of Windows, Linux, Active Directory, Entra ID, networking, and enterprise IT infrastructure.

• Deep understanding of AI-related cyber threats and defensive approaches.

• Familiarity with Autonomous SOC concepts.

Advantage

• Experience with MITRE ATT&CK and translating TTPs into detection logic.

• Red Team / Purple Team / Penetration Testing experience.

• Experience with Breach & Attack Simulation platforms.

• Relevant certifications such as GCIH, GCFA, GCIA, OSCP, CRTO, or equivalent.

• Strong English communication skills.