Defensive Cyber Security Researcher

About the role

Novartis is hiring a Defensive Cyber Security Researcher (internal title: Associate Director, DDIT ISC Security Research) in Tel Aviv, Israel, in a new Think Tank group of security researchers. The role challenges Novartis' information security defenses, application security and data protection, and works closely with incident response and monitoring. About three days per week are spent in the office.

Key responsibilities

• Hunt for emerging threats among large volumes of signals, extract insights and indicators of compromise, and analyse adversary tactics, tools and processes.
• Take part in threat-hunting missions using threat intelligence, anomalous log analysis and brainstorming to detect and eradicate threat actors on the network.
• Support large-scale and complex security incidents, tune alerts, and carry out static and dynamic malware reverse engineering, memory and disk forensics.
• Produce technical reports and review detection infrastructure alerts, recommending improvements.
• With the Security Operations Center, build dashboards and reports on threats, suspicious activity and malware.
• Research AI-specific security risks (adversarial use of AI models, prompt injection, data poisoning, shadow AI, LLM-assisted attacks) and turn findings into defensive guidance and detection rules.
• Work with Cyber Threat Intelligence teams to operationalise feeds, enrich hunting with external and internal data, and feed IOCs, TTPs and adversary profiles back into intelligence pipelines.

Required profile

• 5+ years in incident response / CERT or 5+ years in malware investigations.
• Strong understanding of the cyber attacker kill chain and of Active Directory and Entra ID / Azure AD security, including attack paths, BloodHound analysis, tiering models and Conditional Access.
• Solid understanding of AI security risks and ability to advise on AI-related threat exposure.
• Experience with SOC and CTI teams, including joint detection engineering, alert tuning and threat briefings.
• Familiarity with Red Teaming tools, the nation-state (APT) threat landscape, and good teamwork and communication skills.

Required skills

• Active Directory, Entra ID / Azure AD, BloodHound, Conditional Access
• Wireshark, Cobalt Strike
• Scripting with Python, Perl or Ruby
• Cyber threat hunting and threat intelligence

Desirable: GIAC, EC-Council or Offensive Security certifications. The role is hybrid, with three days per week in the office.