# Security Analyst- Tier 2

**Company**: Nebius
**Location**: Tel Aviv
**Work arrangement**: onsite
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/nebius/jobs/4590161101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_71b14baa-efc

## Description

Nebius is seeking an experienced Security Analyst - Tier 2 for its Security Operations Center (SOC) in Tel Aviv, Israel.

## Role Overview

This role is a hands-on position built for depth, serving as the investigative core of the SOC, focused on evidence and grounded conclusions. The Security Analyst - Tier 2 reports to the SOC Manager, under the Detection and Response function within the CISO Office.

## Key Responsibilities

- Investigate escalated security alerts across endpoint, identity, cloud, email, and network layers.

- Determine scope, impact, and root cause using EDR, SIEM, and supporting telemetry.

- Escalate suspected incidents to the Incident Response team and complex investigations to Tier 3.

- Provide structured feedback to relevant stakeholders on detection or prevention quality, false-positive patterns, and coverage gaps discovered during investigations.

- Contribute to and refine SOC runbooks, triage guides, and investigation procedures.

- Review Tier 1 escalations, coach on handoff quality, and act as the analytical reference during triage.

- Document investigations to a standard that supports handoff, quality review, and lessons learned.

- Participate in the on-call rotation, acting as the investigative point of contact outside business hours.

## Required Qualifications:

### Experience

- Around 5-7 years of hands-on security operations experience, with proven depth in alert investigation.

- Experience taking investigations to a clear verdict, including confirmed incidents.

### Technical Expertise

- Strong working command of EDR platforms and SIEM-based investigation, including writing and adapting queries independently.

- Solid understanding of attacker techniques, with the ability to map findings to MITRE ATT&CK in analysis and reporting.

- Investigation capability across at least two of: endpoint, identity, cloud, email, or network domains.

- Windows and Linux internals at the depth required for log and artifact analysis: processes, authentication flows, and persistence mechanisms.

- Solid networking fundamentals: TCP/IP, DNS, HTTP/S, and the ability to interpret network telemetry.

- Scripting ability (Python or similar) for analysis at scale, and familiarity with SOAR platforms.

- Certifications such as BTL2, OSDA, or CDSA are an advantage.

### Leadership & Communication

- Intellectual honesty, clearly distinguishing important and vague data, what is known, what is assumed, and what is still unknown.

- Collaborative escalation habits, hands off with context and stays available to support what comes next.

- Structured written communication, writing investigation notes that tell the story on their own.

- Fluent in English, written and verbal, comfortable working with international teams and stakeholders.

## Benefits & Perks:

- Competitive compensation

- Career growth and learning opportunities

- Flexibility and ownership

- Collaborative and innovative culture

- Opportunity to work on impactful AI projects

- International environment and talented teams

## Skills

### Required
- EDR platforms
- SIEM-based investigation
- MITRE ATT&CK
- endpoint
- identity
- cloud
- email
- network domains
- Windows internals
- Linux internals
- TCP/IP
- DNS
- HTTP/S
- Python scripting
- SOAR platforms

### Nice to have
- BTL2
- OSDA
- CDSA

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/nebius/jobs/4590161101?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)