Senior SecOps Engineer

About the role

Semperis is looking for a hands-on Senior Security Operations Engineer in Tel Aviv. This is an engineering-focused role: you will identify security problems, understand their root causes and work directly with the teams that fix them. You will strengthen threat detection, incident response, vulnerability management and cloud security operations through investigation, engineering and automation, and you will work closely with Cloud Security, Identity and IT, AppSec, Product Engineering, Platform Engineering, GRC and service owners.

Key responsibilities

• Improve SIEM, EDR, cloud, identity, email and security monitoring, and tune detection rules, analytics, dashboards, alert routing and investigation playbooks
• Investigate alerts and incidents, support high-severity incident response and contribute to post-incident improvements
• Triage vulnerability, exposure, endpoint patching and CSPM/CWP findings, validate them, assess risk, set priorities, track remediation and verify closure
• Partner with Cloud Security on posture-management rules, alert tuning, cloud logging and recurring misconfiguration analysis, and define monitoring needs for new cloud services and SaaS
• Monitor privileged activity, develop detections for risky identity, endpoint and cloud administration, and support endpoint hardening
• Build scripts, integrations, workflows and playbooks, monitor telemetry coverage and maintain metrics on MTTD, MTTR, alert quality, detection coverage and vulnerability risk
• Maintain runbooks, technical documentation and operational records
• Evaluate AI tools, agents and MCP integrations, design guardrails (least privilege, sandboxed execution, egress restrictions, human approval), monitor prompts and outputs for prompt injection and data exposure, and run controlled pilots and adversarial tests
• Translate findings into clear actions, guide engineering and IT teams, mentor analysts and engineers, and balance risk, effort, availability and business priorities

Required profile

• 5+ years of hands-on experience in Security Operations, Security Engineering, Detection Engineering, Incident Response or a related field
• Strong experience with SIEM operations, detection engineering, alert triage, investigation and incident response
• Practical experience with vulnerability management, endpoint patching and hardening, CSPM/CWP, cloud security posture or attack-surface analysis
• Understanding of identity and access risks, privileged activity, risky sign-ins and cloud administration
• Understanding of modern AI security risks (prompt injection, data leakage, tool misuse, AI supply-chain risk)
• Ability to query and analyze security data with KQL, SQL or equivalent, and to automate with Python, PowerShell, JavaScript or a comparable language
• Strong technical writing, communication and independent decision-making under pressure

Preferred qualifications

• Microsoft Sentinel, Defender, Log Analytics, SOAR or similar platforms
• Familiarity with MITRE ATT&CK, Sigma, YARA, threat hunting or detection testing
• Infrastructure-as-code, CI/CD, containers or Kubernetes security
• Endpoint security, privileged access workstations, application control
• SOC 2, ISO 27001, NIST, FedRAMP or similar assurance experience
• Relevant security certifications

The role is hybrid, with up to three days per week in the office and remote work the rest of the time.