# Senior Security Analyst (MDR-Israel)

[Artemis](https://gurify.com/jobs?q=Artemis) · Israel · Posted 4 days ago

Senior

[Security](https://gurify.com/jobs/security)

[Apply on the original posting → (opens in a new tab)](https://jobs.ashbyhq.com/artemis/7299c386-d1b6-41f6-85d2-75ebfe17f6a8)

## Job description

Artemis is building the future of AI-driven cybersecurity, helping companies defend themselves effectively in an era where AI is fighting AI on the cyber battlefield.

Our platform brings a new approach to the $100B security operations market, building a live model of each customer's environment and using AI agents to detect, investigate, hunt, and respond to threats at machine speed. Just one year after our founding, Artemis is one of the fastest-growing cybersecurity companies of all time, with customers including multiple Fortune 500 companies, Global 2000 enterprises, and AI innovators like Cursor.

We have raised $70M from Felicis, First Round Capital, Theory Ventures, Two Sigma Ventures, Lockstep VC and Brightmind. We are also backed by some of the most prominent operators in cybersecurity, including the CEO of Crowdstrike, the former CEO and CTO of Splunk, and the founders of Abnormal AI and Demisto.

Artemis's founders have built and scaled security products used by tens of thousands of customers. Shachar Hirshberg (CEO) led Amazon GuardDuty, the world's largest cloud detection product, was an early employee at Demisto, the company that invented the SOAR category, was an engineering leader at Palo Alto Networks, and holds an MBA from Harvard. Dan Shiebler (CTO) led all AI and machine learning at Abnormal AI, the pioneer of behavior-based detection, spent five years building analytics using machine learning and vector databases at Twitter, and holds a PhD in machine learning from Oxford.

Our team of software engineers, AI researchers, security engineers, and product designers comes from Google, Meta, AWS, Wiz, CrowdStrike, SentinelOne, Abnormal AI, Perplexity, Bridgewater, Mercor, CERN, and more.

We're growing fast and looking for builders who want to help us serve our rapidly expanding customer base.

### Job Overview

We're looking for a Senior Security Analyst to join Apollo, the managed detection and response service Artemis delivers on top of its platform, as one of its founding analysts. Apollo analysts are the senior security minds our customers count on: the people who determine what a threat really is, what it means for that business, and what happens next. You will be one of the few who establish how that work gets done before the team scales.

The Artemis platform is built to give you the strongest possible starting position. Detections are written for each customer's environment, cases arrive with the investigation done and the evidence assembled, response actions come staged and impact-checked, and the platform already holds a living picture of every user, device, account, and AI agent in the environment. The routine work that fills most analysts' days is handled, which means your day is spent on the work that actually calls for an expert.

You will lead investigations across cloud, identity, endpoint, and SaaS, own the decision on the cases you take, guide customers through what matters and why, and carry incidents from first signal to a clean resolution. Because you work across the full range of environments we protect, you will build fluency in modern attacker tradecraft far faster than a single environment allows. And your reach extends well past the case. You sit with the engineers building the platform, so what you learn in one investigation can ship into the product and go on protecting every customer we defend.

### Responsibilities

- Own the investigation and the decision - Take cases from pickup to close: establish what happened, determine the impact and blast radius, set the verdict and severity, and put your reasoning on the record. You are the one who makes the call.

- Investigate with real depth - Reconstruct attacker activity across identity, cloud, endpoint, and SaaS telemetry: initial access, lateral movement, persistence, and exfiltration. Pair AI-assisted investigation with hands-on log analysis, and know which one to lean on for what.

- Drive response, with the customer in control - Recommend and execute containment within each customer's authorized limits, with every action impact-previewed and reversible before it runs. Where the decision belongs to the customer, bring them the recommended action, its full impact, and a clear next step.

- Move at the speed the threat demands - Work by risk, acknowledge and reach a verdict inside the response targets for each severity, and keep the most consequential work moving first.

- Be the security partner customers trust - You are the voice the customer hears. Your summaries, your reasoning, and your final analysis reach them in your own words.

- Hunt what nothing has alerted on yet - Run hypothesis-driven and AI-assisted threat hunts across customer environments, and turn what you surface into new cases and new detections.

- Help design the service, not just deliver it - Founding analysts shape what Apollo becomes: the investigative standards, the response workflows, the reporting customers receive, and the console the team works in. You will be in the room where those decisions get made, and the improvements you argue for get built.

- Make the platform sharper - Your verdicts, your reasoning, and the patterns you recognize feed straight into detection engineering and product, so a problem you solve once gets engineered away rather than worked twice.

### Qualifications

- 4+ years of hands-on security operations experience in a SOC, MSSP, or MDR environment, at a senior or Tier 3 level where the investigation ended with your decision

- Proven investigation depth across identity (Okta, Entra ID), cloud (AWS, Azure, GCP), endpoint (EDR), and SaaS (Microsoft 365, Google Workspace)

- Fluency in attacker tactics, techniques, and procedures (MITRE ATT&CK) and how they present in real telemetry

- Rigor about evidence: you know what separates suspicious from confirmed, and exactly what you need to see to close that gap

- Hands-on experience working with AI-assisted investigation or automation, and the judgement to know where it is strong and where it needs you

- Strong customer-facing instincts. You have walked the people affected by a live security situation through what is happening and what to do about it

- Excellent written communication. What you write reaches the customer as you wrote it

- A high personal bar for the quality of your analysis, and a preference for being measured on it

- Comfortable working a defined shift as analyst coverage expands to 24x7

### Bonus

- Experience in a multi-tenant MDR or MSSP practice, working across several customer environments

- Experience writing or tuning detection rules (Sigma, YARA-L, SPL, KQL, or similar)

- Incident command experience, including customer executive briefings

- Dedicated threat hunting or DFIR background

- Daily hands-on use of AI or agentic coding tools to build your own tooling

Why Work at Artemis?

- Join early enough to shape it. A founding analyst leaves fingerprints on all of it: how the service is designed, the standards the team holds, and what customers receive. The way you work a case becomes the standard the analysts who follow you learn from.

- Make a real world impact. Every case you work and every call you make protects a real company and the people who depend on it. You are not working theoretical security problems, you are on the front lines of active defense, with customers who rely on the quality of your judgement.

- Range you cannot get anywhere else. You work across the full set of environments we protect and the full spectrum of attacker behavior we see, so a quarter here builds experience that years inside one environment cannot.

- Be challenged to be better than ever before. Our team includes some of the smartest and most driven people in the world. We guarantee you will learn more in 1 year here than 10 years in another place.

- Push the boundaries of technology. The platform handles the detection, investigation, and prioritization that consume most analysts' days, so your time goes to judgement, response, and the customer. You will help define what an AI-native SOC actually looks like.

- Innovative culture. We obsess about customers, move fast with high quality, and value open communication, mentorship and learning. You will have the autonomy to drive investigations, shape the platform, and own outcomes, not just follow a runbook.

**Live in Artemis’s hiring system.** Read from the company's own applicant tracking system, not reposted from a job board — so it's a real, open requisition rather than an ad that outlived the role.

We remove it as soon as it disappears at source.

## More jobs like this

- NO [Israel at Novee Security](https://gurify.com/job/israel-at-novee-security-at-noveesecurity-bc1ab103d07f) Noveesecurity · Tel Aviv-Yafo, Israel · last week
- NO [Account Executive & Channels- Israel](https://gurify.com/job/account-executive-channels-israel-at-noveesecurity-27ccccd24d04) Noveesecurity · Tel Aviv-Yafo, Israel · 4 days ago
- GU [Technical Product Manager - Security](https://gurify.com/job/technical-product-manager-security-at-guardio-860403bc546c) Guardio · Tel Aviv-Yafo, Israel · last week
- NO [Account Executive & Channels- Israel](https://gurify.com/job/account-executive-channels-israel-at-noveesecurity-a71dee5cd297) Noveesecurity · Tel Aviv-Yafo, Israel · last week
- CN [Product Manager – Data Security](https://gurify.com/job/product-manager-data-security-at-cato-networks-5cd3a89da50d) Cato Networks · Tel Aviv District, Israel · 4 days ago
- VI [Senior Application Security Engineer](https://gurify.com/job/senior-application-security-engineer-at-via-29d6a84848f6) Via · Tel Aviv · last week

```json
{"@context":"https://schema.org/","@type":"JobPosting","title":"Senior Security Analyst (MDR-Israel)","description":"\u003Cp\u003EArtemis is building the future of AI-driven cybersecurity, helping companies defend themselves effectively in an era where AI is fighting AI on the cyber battlefield.\u003C/p\u003E\u003Cp\u003EOur platform brings a new approach to the $100B security operations market, building a live model of each customer\u0026#39;s environment and using AI agents to detect, investigate, hunt, and respond to threats at machine speed. Just one year after our founding, Artemis is one of the fastest-growing cybersecurity companies of all time, with customers including multiple Fortune 500 companies, Global 2000 enterprises, and AI innovators like Cursor.\u003C/p\u003E\u003Cp\u003EWe have raised $70M from Felicis, First Round Capital, Theory Ventures, Two Sigma Ventures, Lockstep VC and Brightmind. We are also backed by some of the most prominent operators in cybersecurity, including the CEO of Crowdstrike, the former CEO and CTO of Splunk, and the founders of Abnormal AI and Demisto.\u003C/p\u003E\u003Cp\u003EArtemis\u0026#39;s founders have built and scaled security products used by tens of thousands of customers. Shachar Hirshberg (CEO) led Amazon GuardDuty, the world\u0026#39;s largest cloud detection product, was an early employee at Demisto, the company that invented the SOAR category, was an engineering leader at Palo Alto Networks, and holds an MBA from Harvard. Dan Shiebler (CTO) led all AI and machine learning at Abnormal AI, the pioneer of behavior-based detection, spent five years building analytics using machine learning and vector databases at Twitter, and holds a PhD in machine learning from Oxford.\u003C/p\u003E\u003Cp\u003EOur team of software engineers, AI researchers, security engineers, and product designers comes from Google, Meta, AWS, Wiz, CrowdStrike, SentinelOne, Abnormal AI, Perplexity, Bridgewater, Mercor, CERN, and more.\u003C/p\u003E\u003Cp\u003EWe\u0026#39;re growing fast and looking for builders who want to help us serve our rapidly expanding customer base.\u003C/p\u003E\u003Ch3\u003EJob Overview\u003C/h3\u003E\u003Cp\u003EWe\u0026#39;re looking for a Senior Security Analyst to join Apollo, the managed detection and response service Artemis delivers on top of its platform, as one of its founding analysts. Apollo analysts are the senior security minds our customers count on: the people who determine what a threat really is, what it means for that business, and what happens next. You will be one of the few who establish how that work gets done before the team scales.\u003C/p\u003E\u003Cp\u003EThe Artemis platform is built to give you the strongest possible starting position. Detections are written for each customer\u0026#39;s environment, cases arrive with the investigation done and the evidence assembled, response actions come staged and impact-checked, and the platform already holds a living picture of every user, device, account, and AI agent in the environment. The routine work that fills most analysts\u0026#39; days is handled, which means your day is spent on the work that actually calls for an expert.\u003C/p\u003E\u003Cp\u003EYou will lead investigations across cloud, identity, endpoint, and SaaS, own the decision on the cases you take, guide customers through what matters and why, and carry incidents from first signal to a clean resolution. Because you work across the full range of environments we protect, you will build fluency in modern attacker tradecraft far faster than a single environment allows. And your reach extends well past the case. You sit with the engineers building the platform, so what you learn in one investigation can ship into the product and go on protecting every customer we defend.\u003C/p\u003E\u003Ch3\u003EResponsibilities\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EOwn the investigation and the decision - Take cases from pickup to close: establish what happened, determine the impact and blast radius, set the verdict and severity, and put your reasoning on the record. You are the one who makes the call.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EInvestigate with real depth - Reconstruct attacker activity across identity, cloud, endpoint, and SaaS telemetry: initial access, lateral movement, persistence, and exfiltration. Pair AI-assisted investigation with hands-on log analysis, and know which one to lean on for what.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDrive response, with the customer in control - Recommend and execute containment within each customer\u0026#39;s authorized limits, with every action impact-previewed and reversible before it runs. Where the decision belongs to the customer, bring them the recommended action, its full impact, and a clear next step.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EMove at the speed the threat demands - Work by risk, acknowledge and reach a verdict inside the response targets for each severity, and keep the most consequential work moving first.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EBe the security partner customers trust - You are the voice the customer hears. Your summaries, your reasoning, and your final analysis reach them in your own words.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHunt what nothing has alerted on yet - Run hypothesis-driven and AI-assisted threat hunts across customer environments, and turn what you surface into new cases and new detections.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHelp design the service, not just deliver it - Founding analysts shape what Apollo becomes: the investigative standards, the response workflows, the reporting customers receive, and the console the team works in. You will be in the room where those decisions get made, and the improvements you argue for get built.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EMake the platform sharper - Your verdicts, your reasoning, and the patterns you recognize feed straight into detection engineering and product, so a problem you solve once gets engineered away rather than worked twice.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EQualifications\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003E4\u002B years of hands-on security operations experience in a SOC, MSSP, or MDR environment, at a senior or Tier 3 level where the investigation ended with your decision\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EProven investigation depth across identity (Okta, Entra ID), cloud (AWS, Azure, GCP), endpoint (EDR), and SaaS (Microsoft 365, Google Workspace)\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EFluency in attacker tactics, techniques, and procedures (MITRE ATT\u0026amp;CK) and how they present in real telemetry\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ERigor about evidence: you know what separates suspicious from confirmed, and exactly what you need to see to close that gap\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHands-on experience working with AI-assisted investigation or automation, and the judgement to know where it is strong and where it needs you\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EStrong customer-facing instincts. You have walked the people affected by a live security situation through what is happening and what to do about it\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExcellent written communication. What you write reaches the customer as you wrote it\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EA high personal bar for the quality of your analysis, and a preference for being measured on it\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EComfortable working a defined shift as analyst coverage expands to 24x7\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EBonus\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EExperience in a multi-tenant MDR or MSSP practice, working across several customer environments\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience writing or tuning detection rules (Sigma, YARA-L, SPL, KQL, or similar)\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EIncident command experience, including customer executive briefings\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDedicated threat hunting or DFIR background\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EDaily hands-on use of AI or agentic coding tools to build your own tooling\u003C/li\u003E\u003C/ul\u003E\u003Cp\u003EWhy Work at Artemis?\u003C/p\u003E\u003Cul\u003E\u003Cli\u003EJoin early enough to shape it. A founding analyst leaves fingerprints on all of it: how the service is designed, the standards the team holds, and what customers receive. The way you work a case becomes the standard the analysts who follow you learn from.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EMake a real world impact. Every case you work and every call you make protects a real company and the people who depend on it. You are not working theoretical security problems, you are on the front lines of active defense, with customers who rely on the quality of your judgement.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ERange you cannot get anywhere else. You work across the full set of environments we protect and the full spectrum of attacker behavior we see, so a quarter here builds experience that years inside one environment cannot.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EBe challenged to be better than ever before. Our team includes some of the smartest and most driven people in the world. We guarantee you will learn more in 1 year here than 10 years in another place.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPush the boundaries of technology. The platform handles the detection, investigation, and prioritization that consume most analysts\u0026#39; days, so your time goes to judgement, response, and the customer. You will help define what an AI-native SOC actually looks like.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EInnovative culture. We obsess about customers, move fast with high quality, and value open communication, mentorship and learning. You will have the autonomy to drive investigations, shape the platform, and own outcomes, not just follow a runbook.\u003C/li\u003E\u003C/ul\u003E","identifier":{"@type":"PropertyValue","name":"Gurify","value":"senior-security-analyst-mdr-israel-at-artemis-54d9e3ca4eeb"},"url":"https://gurify.com/job/senior-security-analyst-mdr-israel-at-artemis-54d9e3ca4eeb","datePosted":"2026-10-11","validThrough":"2026-11-29T23:59:59Z","hiringOrganization":{"@type":"Organization","name":"Artemis","sameAs":"https://jobs.ashbyhq.com/artemis"},"directApply":false,"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressCountry":"IL"}}}
```

```json
{"@context":"https://schema.org/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Jobs","item":"https://gurify.com/jobs"},{"@type":"ListItem","position":2,"name":"Israel","item":"https://gurify.com/jobs/israel"},{"@type":"ListItem","position":3,"name":"Senior Security Analyst (MDR-Israel)","item":"https://gurify.com/job/senior-security-analyst-mdr-israel-at-artemis-54d9e3ca4eeb"}]}
```