SOC Analyst (Hybrid, Israel)

About the role

Cato Networks, a provider of cloud-delivered enterprise networking and security, is hiring a SOC Analyst in Israel. This is a hybrid analyst and operations role covering real-time monitoring, detection, investigation and response to security incidents in a 24x7 environment. You will be the only SOC analyst on site and act as the local anchor for the Cyber Security, IT, Operations and R&D teams, bridging them with the offshore analyst team.

Key responsibilities

• Monitor SIEM, EDR, IPS, mail security, CASB, cloud and identity security solutions to identify potential threats.
• Investigate, contain and resolve incidents at first level of escalation, following defined procedures and SLAs.
• Coordinate major incidents until ownership transfers to the relevant team, keeping action items tracked.
• Analyze logs, network traffic, endpoint telemetry and alerts to determine root cause, scope, impact and remediation.
• Operate the SIEM day-to-day, including data onboarding, field mapping, dashboards and detection rules.
• Manage exclusions and exceptions across the security stack, reviewing requests and applying scoped, time-bound exclusions.
• Build and maintain automations and AI/LLM workflows for alert triage, investigation support and documentation, with guardrails and quality control.
• Maintain detailed incident tickets and audit trails, and mentor analysts on tooling and methodology.
• Support compliance reporting, management reviews and threat intelligence updates.

Required profile

• 3-5 years of hands-on experience in a SOC or cybersecurity operations role.
• Ownership and autonomy, able to work as the only on-site analyst and set priorities independently.
• Excellent communication skills and ability to work with distributed teams across time zones.
• Proficiency in written and spoken English is a must.

Required skills

• SIEM platform experience, including detection rule engineering (advantage: Elastic).
• EDR and other security tools (advantage: CrowdStrike Falcon).
• Practical experience with AI/LLM tools in technical workflows.
• Broad knowledge of threat vectors, malware, network protocols, OS internals, identity, cloud and SaaS security.