About the Role You will be at the center of our detection and response operations - investigating real threats across endpoint, network, identity, and cloud environments. This is a tierless role - you own your cases end-…
Sign up with Clera and we'll reach out the moment a role actually fits you — no more spraying applications into the void.
Full-time
Posted 38d ago
~40 hrs/week
Responsibilities
Investigate and manage security threats across endpoint, network, identity, and cloud environments from detection through containment. Contribute to detection rule tuning and maintain incident response runbooks to improve team efficiency.
Requirements
Requires a solid understanding of network protocols, attacker techniques, and hands-on experience with EDR and SIEM platforms. Candidates must be fluent in English and available for rotating 9-hour shifts, including nights and weekends.
Full job description
About the Role
You will be at the center of our detection and response operations - investigating real threats across endpoint, network, identity, and cloud environments.
This is a tierless role - you own your cases end-to-end, from first alert through containment and documentation, across multiple client environments simultaneously.
What You'll Do
Investigate alerts across multiple EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint).
Conduct end-to-end investigations correlating data across firewall, DC, email security, EDR, and cloud audit logs.
Investigate threats across cloud environments (AWS, Azure, GCP) - including identity abuse, misconfigurations, and cloud-native attack techniques.
Monitor and triage alerts; determine scope, severity, and escalation path.
Classify, document, and track cases through their full lifecycle using ticketing and case management systems.
Contribute to detection rule tuning across SIEM and EDR platforms to reduce false positives and close coverage gaps.
Maintain shift handover documentation and contribute to IR runbooks and playbooks.
Share knowledge through peer walkthroughs, ticket reviews, and internal sessions that raise the team's level.
What You'll Bring
Solid grasp of network protocols, attack patterns, and core security controls (firewall, IDS/IPS, proxy, WAF).
Hands-on familiarity with at least one EDR platform and SIEM environment.
Understanding of Windows/Linux internals relevant to attacker techniques (persistence, lateral movement, credential access).
Foundational knowledge of cloud environments - IAM, logging, and common attack surfaces.
Fluent written and spoken English.
Availability for 9-hour rotating shifts, including nights and weekends (Sun–Sat).
A drive to keep learning - you are always in a cycle of improving your skills, deepening your knowledge, and raising your own bar.
Self-motivated and independent - you take ownership, dig deep into every investigation, and push yourself to find the full answer.
Related keywords
SOC AnalystCrowdStrikeSentinelOneMicrosoft Defender for EndpointAWSAzureGCPFirewallIDS/IPSWAFSIEMEDRIAMIncident ResponseThreat HuntingCloud Audit Logs
At CYCL, we merge cloud security experts with AI-based behavioral detection to form our Cloud Native Managed CDR solution. By utilizing both agentless and lite agent-based cloud-native technologies, we significantly lighten the load for your security teams. We conduct comprehensive analysis and smart noise reduction, ensuring your attention is utilized only for the alerts and identified risks that truly matter. This allows you to leverage your cloud security investments to their fullest potential without the clutter of additional tools.
Managed Cloud Detection and Response
Rely on CYCL’s extensive cloud expertise and sophisticated analytics to proactively detect, investigate, and neutralize threats. Our platform turns complex data into distilled, actionable insights, ensuring your cloud environment is not just monitored, but genuinely secure, compliant, and resilient.
Your Cloud, Protected
Our Managed Cloud Detection and Response (CDR) platform integrates cutting-edge AI with expert analytics to proactively secure your cloud infrastructure. It supports both agentless and lite agent-based configurations, ensuring flexibility and comprehensive coverage across various cloud platforms.
Offices: 1013 Centre Rd, Wilmington, Delaware 19805, US · 2 Nim Blv., Rishon Lezion, Israel 7546320, IL
At CYCL, we merge cloud security experts with AI-based behavioral detection to form our Cloud Native Managed CDR solution. By utilizing both agentless and lite agent-based cloud-native technologies, we significantly lighten the load for your security teams. We conduct comprehensive analysis and smart noise reduction, ensuring your attention is utilized only for the alerts and identified risks that truly matter. This allows you to leverage your cloud security investments to their fullest potential without the clutter of additional tools.
Managed Cloud Detection and Response
Rely on CYCL’s extensive cloud expertise and sophisticated analytics to proactively detect, investigate, and neutralize threats. Our platform turns complex data into distilled, actionable insights, ensuring your cloud environment is not just monitored, but genuinely secure, compliant, and resilient.
Your Cloud, Protected
Our Managed Cloud Detection and Response (CDR) platform integrates cutting-edge AI with expert analytics to proactively secure your cloud infrastructure. It supports both agentless and lite agent-based configurations, ensuring flexibility and comprehensive coverage across various cloud platforms.
Offices: 1013 Centre Rd, Wilmington, Delaware 19805, US · 2 Nim Blv., Rishon Lezion, Israel 7546320, IL