{"id":1175170,"url":"https://alion.io/job/cato-networks-soc-analyst","title":"SOC Analyst","company":{"id":7240,"name":"Cato Networks","domain":"catonetworks.com","url":"https://alion.io/company/cato-networks","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":84,"open_postings":37,"ghost_share":0,"stale_share":0.432,"repost_share":0,"time_to_fill_p50_days":64,"computed_at":"2026-10-01T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Tel Aviv, Israel"],"countries":["IL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":97000,"max_usd":240000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":414},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Exabeam","optional":false},{"name":"Falcon","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"MISP","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-09-02T14:24:51Z","employer_posted_date":"2026-09-02","last_verified_at":"2026-10-02T00:02:38Z","board_verified":true,"closed_at":null,"days_open":29,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":29},"description":"Welcome to the future of cloud networking and security! \nCato Networks is the first company to converge enterprise networking and security into one centralized and global service that is delivered by cloud. It is led by networking and security pioneer Shlomo Kramer (Check Point, Imperva) and early investor (Palo Alto Networks, Exabeam, Trusteer and more). Cato’s unique technology inspired a brand-new product category, later named “SASE” by Gartner and a market expected to reach $28.5 billion by 2028.\nThis is your opportunity to get on the rocket ship and join a company that is building a cutting-edge enterprise network and secure cloud platform, and is on a fast track to becoming the worldwide market leader - don’t miss it!\nAs a SOC Analyst, you will be part of the team responsible for real-time monitoring, detection, investigation, and response to security incidents affecting our global infrastructure and services, within a 24x7 operational environment. \nThis is a hybrid analyst and operations role. Beyond investigating incidents, you will own significant parts of how the SOC runs: the SIEM platform, the detection rule lifecycle, exclusion and exception handling, response automation, and the AI-assisted workflows we use to accelerate triage and investigation. \nYou will be the only SOC analyst based in Israel, while the rest of the analyst team operates from the Philippines. You will act as the SOC’s local anchor - the on-site technical counterpart for the Israel-based Cyber Security, IT, Operations, and R&D teams, and the escalation and knowledge bridge between them and the offshore shifts. The role calls for ownership, independence, and the appetite to build and improve, not only to operate. \nResponsibilities \n Monitoring and Detection: Continuously monitor SIEM, endpoint protection (EDR), IPS, mail security, CASB, cloud, and identity security solutions to identify potential threats. \nIncident Response: Serve as one of the first levels of escalation for security incidents - investigate, contain, and drive resolution before escalating to the senior SecOps members, in accordance with defined procedures and SLAs. \nIncident Coordination: Lead coordination of major incidents until ownership is transferred to the relevant SecOps, IT, Operations, or R&D team; ensure clear communication, escalation, and tracking of action items. \n Threat Analysis: Analyze logs, network traffic, endpoint telemetry, and native (in-tool) alerts to determine root cause, scope, impact, and remediation steps. \nSIEM and Detection Engineering: Own day-to-day operation of the SIEM - data onboarding and ingest pipelines, field mapping and data quality, dashboards and platform health - and write, tune, and maintain detection rules while measuring their effectiveness. \nExclusion and Exception Management: Own the exclusion and exception lifecycle across the security stack: review requests, assess risk, apply scoped, time-bound exclusions, and revalidate them periodically. \n Automation and AI-Assisted Operations: Build and maintain automations across the SOC toolchain (enrichment, containment, ticketing, reporting), and design, implement, and validate AI/LLM-based workflows for alert triage, investigation support, and documentation - including guardrails and quality control of AI output. \nInvestigation Documentation: Create and maintain detailed incident tickets, including investigation audit trail, action items, and timelines. \nTechnical Leadership: Act as the senior operational reference for the analyst team: help prioritize workload, assure investigation quality, maintain consistent handling of incidents, escalations, and shift handovers, and mentor analysts on tooling and methodology. \nCollaboration: Work closely with the Cyber Security team, IT, Operations, and R&D locally, and with the offshore SOC team across time zones. \nContinuous Improvement: Drive improvements to detection logic, automation, operational runbooks, and shift handover documentation based on lessons learned from incidents. \nCompliance and Reporting: Support reporting for compliance audits, management reviews, and threat intelligence updates. \nRequirements \n3-5 years of hands-on experience in a SOC or cybersecurity operations role. \nProven experience with a SIEM platform, including detection rule engineering and content development (Advantage: Elastic). \nExperience with EDR and additional security tools and platforms (Advantage: CrowdStrike Falcon). \nPractical experience using AI/LLM tools in technical workflows, with a clear understanding of their limitations and failure modes. \nBroad technical foundation across the SOC domain: threat vectors, malware behavior, network protocols, operating system internals, identity, cloud, and SaaS security controls. \nStrong analytical and problem-solving skills, with the ability to correlate events across multiple data sources and think beyond the alert. \nHigh degree of ownership and autonomy - able to operate as the only analyst on site, set priorities independently, and drive tasks to closure. \nExcellent communication skills and the ability to work effectively with distributed teams across time zones. \nAbility to work effectively on time-sensitive tasks, with a service-oriented approach toward internal stakeholders. \nProficiency in written and verbal English is a must. \nAdvantage \nExperience building SOAR pipelines or agentic AI workflows in a security context. \nExperience with cloud security monitoring (AWS, Azure) and container/Kubernetes telemetry. \nExperience working with or supporting an offshore/outsourced SOC team. \nExperience with threat intelligence platforms (e.g., MISP) and intel-driven detection.","description_format":"text","description_chars":5689,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Israel","iso":"IL","kind":"country"},{"name":"Philippines","iso":"PH","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Cybersecurity","Network Security","Cloud Security"],"lifecycle":[{"event":"open","at":"2026-09-24T11:17:24Z"}],"liveness":{"score":69,"band":"ok","label":"Likely open","p_open":1,"p_active":0.764,"p_room":0.9,"age_days":28,"expected_fill_days":64,"reasons":["conf:8","velocity","win:mid"],"computed_at":"2026-10-01T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/cato-networks-soc-analyst","json_url":"https://alion.io/job/cato-networks-soc-analyst.json","meta":{"generated_at":"2026-10-02T02:54:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":3953,"day_limit":5000,"remaining_today":1047,"minute_limit":60,"resets_at":"2026-10-03T00:00:00Z"}}}