Security Operations Engineer

B2Tech is looking for a mid-level Security Operations Engineer to strengthen day-to-day security monitoring, identity and endpoint protection, and cloud and network security controls across our hybrid AWS and on-prem environment.

This is a hands-on operational role: you will triage alerts, harden configurations, and execute on remediation plans defined by the SecOps Team Lead, while building toward greater independent ownership of specific security domains.

Key Responsibilities Monitoring & Incident Response

• Manage and triage security alerts in Coralogix (SIEM), escalating and documenting incidents per established SOC/NOC escalation procedures
• Investigate suspicious activity using Entra ID sign-in logs, SentinelOne EDR telemetry, and Cloudflare audit logs
• Support incident investigations, including timeline reconstruction and evidence collection

Identity & Endpoint Security

• Administer and monitor Entra ID Conditional Access policies; investigate authentication anomalies and access issues
• Manage SentinelOne EDR agent health, policy configuration, and device control across the fleet
• Support Microsoft Intune compliance and configuration policies

Cloud & Infrastructure Security

• Manage AWS IAM permissions, cross-account access, and Secrets Manager configurations following least-privilege principles
• Monitor AWS CloudTrail activity and support AWS Organizations / SCP governance
• Assist in maintaining and reviewing Terraform-managed Cloudflare WAF rules and Zero Trust (WARP) access policies

Network & Application Security

• Monitor and tune Cloudflare WAF rules, rate limiting, and bot/challenge configurations
• Support Zero Trust network access rollout and troubleshooting for end users

Collaboration & Process

• Work with SOC, NOC, and Tech Support teams on cross-functional escalations
• Maintain accurate documentation of configurations, playbooks, and incident records
• Participate in access reviews and support ongoing security posture improvement initiatives

Required Qualifications

• 3-5 years of experience in a security operations, SOC analyst, or IT security engineering role
• Hands-on experience with at least one SIEM platform (e.g., Coralogix, Splunk, Microsoft Sentinel)
• Working knowledge of identity and access management concepts (SSO, Conditional Access, MFA)
• Experience with endpoint detection and response (EDR) tools
• Familiarity with core AWS services and basic cloud security principles
• Understanding of WAF, DNS, and network security fundamentals
• Strong analytical and documentation skills; comfortable working independently on defined tasks

Preferred Qualifications

• Direct experience with Cloudflare (WAF, Zero Trust/WARP)
• Exposure to Infrastructure-as-Code (Terraform) for security rule management
• Experience with Microsoft Intune or other MDM/UEM platforms
• Familiarity with GitHub Enterprise administration and RBAC
• Relevant certifications (Security+, SC-200, AWS Security Specialty, or similar)

WHAT WE OFFER:

• Annual Discretionary Performance Bonus 💵
• Annual Salary Review 📈
• Hybrid Model 🏠
• Semi-flexible Working Hours 🕒
• Keren Hishtalmut contribution from the start date 🎓
• Recuperation Pay 🩺
• ILS 1,000 Monthly Lunch Allowance via Cibus, with No Usage Restrictions 🍽️
• Happy Hour 🍻
• Exciting Career Paths 🎯
• Personalized Learning and Development Programs 📖
• Birthday Leave 🎂
• Marriage Leave Vacation 💍
• Service Awards Gifts 🏅
• Variety of Employee Perks 🎁
• HitechZone membership 🎫