BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.

Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.

The Role

BeyondTrust is a global leader in privileged access management. Our products provide remote access and privileged control capabilities that are deployed across thousands of enterprise environments worldwide. That makes us a high-value target. Nation-state actors, ransomware operators, and sophisticated threat groups actively target companies like ours—not just to compromise our corporate environment, but to reach the customers who trust our software to protect their most sensitive systems. A compromise of BeyondTrust is a compromise of the privileged access layer inside our customers’ networks. We take that responsibility seriously.

As a SOC Analyst on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on. You will monitor, investigate, and respond to security events in an environment where the stakes are real and the adversaries are capable. You will work alongside experienced threat hunters, incident responders, and detection engineers in a collaborative team that values sharp analytical thinking over checkbox compliance.

This team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and to contribute to how we integrate these capabilities into our detection, triage, and response workflows. We are not looking for people who are waiting to be told what to do—we are looking for people who want to build something.

What You’ll Do

Alert Triage & Monitoring 

• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.
• Investigate alerts to determine scope, severity, and whether escalation is warranted.
• Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.
• Classify, document, and track alerts through the full lifecycle using ticketing and case management systems.

Incident Response & Investigation 

• Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.
• Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure.
• Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows.
• Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.
• Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.

Detection Engineering & Threat Intelligence 

• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps.
• Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors.
• Help maintain and evolve detection coverage mapped to MITRE ATT&CK.
• Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts.

AI Integration & Automation 

• Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.
• Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows.
• Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort.
• Partner with engineering teams to improve log ingestion, data quality, and tool integrations.

Operational Excellence 

• Maintain daily operational notes and shift handoff documentation.
• Contribute to and refine IR runbooks, playbooks, and standard operating procedures.
• Participate in on-call rotation for after-hours incident escalation.
• Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities.
• Participate in tabletop exercises, purple team activities, and post-incident reviews. 

What You’ll Bring

• 2+ years of experience in a SOC, security operations, or incident response role.
• Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior.
• Experience with at least one SIEM platform and familiarity with writing search or detection queries.
• Familiarity with EDR platforms and cloud environments (IaaS preferred).
• Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows.
• Strong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences.

Nice To Have

• Experience leading or co-leading complex incident response engagements from triage through remediation.
• Experience with identity and access management platforms and cloud security posture management tools.
• Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows.
• Familiarity with SOAR platforms or orchestration tools for automated response and enrichment.
• Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines.
• Understanding of the privileged access management landscape and the threat actors that target it.
• Track record of evaluating and adopting emerging technologies in a production security environment.

Better Together

Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.

We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.

About Us

BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.

BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.

Learn more at www.beyondtrust.com. 

#LI-DF1

BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.

Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.

The Role

BeyondTrust is a global leader in privileged access management. Our products provide remote access and privileged control capabilities that are deployed across thousands of enterprise environments worldwide. That makes us a high-value target. Nation-state actors, ransomware operators, and sophisticated threat groups actively target companies like ours—not just to compromise our corporate environment, but to reach the customers who trust our software to protect their most sensitive systems. A compromise of BeyondTrust is a compromise of the privileged access layer inside our customers’ networks. We take that responsibility seriously.

As a SOC Analyst on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on. You will monitor, investigate, and respond to security events in an environment where the stakes are real and the adversaries are capable. You will work alongside experienced threat hunters, incident responders, and detection engineers in a collaborative team that values sharp analytical thinking over checkbox compliance.

This team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and to contribute to how we integrate these capabilities into our detection, triage, and response workflows. We are not looking for people who are waiting to be told what to do—we are looking for people who want to build something.

What You’ll Do

Alert Triage & Monitoring 

• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.
• Investigate alerts to determine scope, severity, and whether escalation is warranted.
• Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.
• Classify, document, and track alerts through the full lifecycle using ticketing and case management systems.

Incident Response & Investigation 

• Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.
• Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure.
• Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows.
• Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.
• Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.

Detection Engineering & Threat Intelligence 

• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps.
• Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors.
• Help maintain and evolve detection coverage mapped to MITRE ATT&CK.
• Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts.

AI Integration & Automation 

• Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.
• Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows.
• Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort.
• Partner with engineering teams to improve log ingestion, data quality, and tool integrations.

Operational Excellence 

• Maintain daily operational notes and shift handoff documentation.
• Contribute to and refine IR runbooks, playbooks, and standard operating procedures.
• Participate in on-call rotation for after-hours incident escalation.
• Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities.
• Participate in tabletop exercises, purple team activities, and post-incident reviews. 

What You’ll Bring

• 2+ years of experience in a SOC, security operations, or incident response role.
• Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior.
• Experience with at least one SIEM platform and familiarity with writing search or detection queries.
• Familiarity with EDR platforms and cloud environments (IaaS preferred).
• Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows.
• Strong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences.

Nice To Have

• Experience leading or co-leading complex incident response engagements from triage through remediation.
• Experience with identity and access management platforms and cloud security posture management tools.
• Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows.
• Familiarity with SOAR platforms or orchestration tools for automated response and enrichment.
• Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines.
• Understanding of the privileged access management landscape and the threat actors that target it.
• Track record of evaluating and adopting emerging technologies in a production security environment.

Better Together

Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.

We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.

About Us

BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.

BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.

Learn more at www.beyondtrust.com. 

#LI-DF1

BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cyber security SaaS portfolio.

Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.

The Role

As a Senior Software Development Engineer, you will be crucial in launching and supporting Entitle - BeyondTrust’s Just-In-Time Access Management system. You will be part of a fast-paced team designing, developing, delivering, and maintaining a cloud-based software solution utilizing modern orchestration technologies. This is a unique opportunity for you to step up as a technical leader in solving cloud-scale challenges and deliver a bar-raising platform system. This role is based in our central Tel Aviv office.

What You’ll Do

• Design, build, and maintain highly scalable and resilient backend components, services, and orchestration.
• Deliver outstanding user experience for complex API-based integrations.
• Contribute to the design of systems and provide technical leadership for projects with increasing complexity.
• Review functional and technical requirements to identify gaps and limitations, propose simplifications, and communicate ideas effectively with cross-functional teams.
• Be a bar-raiser for delivering results and taking end-to-end ownership individually and as part of a team.
• Relentless pursuit of high quality by leveraging engineering best practices.

What You’ll Bring

• 5+ years’ experience delivering and supporting enterprise-ready cloud-based systems.
• Solid Understanding of modern design patterns.
• Excellent communication and collaboration skills to work effectively with cross-functional teams.
• Experience with the full lifecycle of development, including product release in an agile environment.
• Experience working on an Agile team in a continuous integration and development environment.
• Hands-on experience in architecting and developing backend services.
• Proficient in Python with a deep understanding of OOP, System Design, Networks and Linux.
• Experience working with public cloud providers: AWS, Google Cloud, and Azure.
• Experience with data engineering technologies: RabbitMQ, S3, ClickHouse, Airflow, Spark, Elasticsearch.
• Experience in connecting to API services with limited functionality or scalability.
• Experience in developing scalable microservices architectures.
• Experience with performance optimization techniques for backend components running on cloud as well as on-prem.
• Understanding of Continuous Integration and Continuous Delivery strategies.
• Understanding of monitoring and alerting strategies.
• Familiarity with unit testing frameworks and end-to-end testing tools.

Who You Are

• You are a team player, eager and open to sharing successes and failures.
• You are flexible and can handle ambiguity and adapt to shifting situations and requirements.
• You are excited about AI and move with urgency to embed it across your work—from day-to-day tasks to production workflows—proactively experimenting, advocating for the right tools, and sharing learnings.
• You take the initiative to fix issues before being assigned to them. You are persistent when facing roadblocks, overcoming them efficiently, and know how to coordinate with others when necessary.
• You hold high standards, continuously raise the bar, and drive our teams to deliver high- quality products, services, and processes.
• You understand software development best practices from appropriate testing paradigms to effective peer code reviews and resilient architectures.
• You know how to balance speed and risks; you make decisions based on data.

Better Together

Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.

We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.

About Us

BeyondTrust is the worldwide leader in intelligent identity and access security, enabling organizations to protect identities, stop threats, and deliver dynamic access. We are leading the charge in innovating identity-first security and are trusted by 20,000 customers, including 75 of the Fortune 100, plus a global ecosystem of partners.

Learn more at www.beyondtrust.com. 

#LI-BS1

BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.

Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.

The Role

BeyondTrust is a global leader in privileged access management. Our products provide remote access and privileged control capabilities that are deployed across thousands of enterprise environments worldwide. That makes us a high-value target. Nation-state actors, ransomware operators, and sophisticated threat groups actively target companies like ours—not just to compromise our corporate environment, but to reach the customers who trust our software to protect their most sensitive systems. A compromise of BeyondTrust is a compromise of the privileged access layer inside our customers’ networks. We take that responsibility seriously.

As a SOC Analyst on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on. You will monitor, investigate, and respond to security events in an environment where the stakes are real and the adversaries are capable. You will work alongside experienced threat hunters, incident responders, and detection engineers in a collaborative team that values sharp analytical thinking over checkbox compliance.

This team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and to contribute to how we integrate these capabilities into our detection, triage, and response workflows. We are not looking for people who are waiting to be told what to do—we are looking for people who want to build something.

What You’ll Do

Alert Triage & Monitoring 

• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.
• Investigate alerts to determine scope, severity, and whether escalation is warranted.
• Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.
• Classify, document, and track alerts through the full lifecycle using ticketing and case management systems.

Incident Response & Investigation 

• Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.
• Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure.
• Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows.
• Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.
• Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.

Detection Engineering & Threat Intelligence 

• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps.
• Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors.
• Help maintain and evolve detection coverage mapped to MITRE ATT&CK.
• Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts.

AI Integration & Automation 

• Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.
• Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows.
• Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort.
• Partner with engineering teams to improve log ingestion, data quality, and tool integrations.

Operational Excellence 

• Maintain daily operational notes and shift handoff documentation.
• Contribute to and refine IR runbooks, playbooks, and standard operating procedures.
• Participate in on-call rotation for after-hours incident escalation.
• Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities.
• Participate in tabletop exercises, purple team activities, and post-incident reviews. 

What You’ll Bring

• 2+ years of experience in a SOC, security operations, or incident response role.
• Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior.
• Experience with at least one SIEM platform and familiarity with writing search or detection queries.
• Familiarity with EDR platforms and cloud environments (IaaS preferred).
• Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows.
• Strong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences.

Nice To Have

• Experience leading or co-leading complex incident response engagements from triage through remediation.
• Experience with identity and access management platforms and cloud security posture management tools.
• Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows.
• Familiarity with SOAR platforms or orchestration tools for automated response and enrichment.
• Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines.
• Understanding of the privileged access management landscape and the threat actors that target it.
• Track record of evaluating and adopting emerging technologies in a production security environment.

Better Together

Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.

We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.

About Us

BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.

BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.

Learn more at www.beyondtrust.com. 

#LI-DF1

BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.

Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.

The Role

BeyondTrust is the worldwide leader in intelligent identity and access security, empowering organizations to protect identities, stop threats, and securely deliver dynamic access. Our industry-leading platform and integrated products offer the most advanced Privileged Access Management (PAM) and Cloud Infrastructure Entitlements Management (CIEM) solutions, enabling enterprises to reduce their attack surface across traditional, cloud, and hybrid environments. 

Entitle, BeyondTrust’s industry leading product offering provides granular, just‑in‑time access and advanced permission management across cloud infrastructure, SaaS, and modern enterprise environments. As part of our vision to become the modern standard for identity security in multi‑cloud infrastructure, we are accelerating toward a future where secure access for humans and machines is automated, intelligent, and increasingly free of human‑managed processes. We place a heavy emphasis on building products that address our customers' modern pain points, making security and compliance a low-effort activity. We value technical curiosity and proactive learning. The ideal PM keeps pace with the market and technology changes, understands the implications, and helps to craft roadmaps that deliver outcomes in support of our customers. 

As a Senior Product Manager for Entitle, you will be a major stakeholder in the product strategy and lead the execution across a cross-functional team. You will collaborate with leadership to shape the long-term vision, partner closely with engineering and design, and own delivery of platform-wide capabilities that scale with our rapidly growing user base.

What You’ll Do

• Develop, execute, and maintain an agile product, roadmap and craft user stories with the broader product management team as a core part of BeyondTrust’s identity security portfolio.
• Define and prioritize features for visibility, permission management, least privilege, compliance automation, and identity governance.
• Oversee the full product lifecycle from concept through launch and performance measurement.
• Champion user needs through AI-driven insights, research, and continuous delivery.
• Translate customer, market, and business requirements into actionable roadmaps and measurable outcomes.
• Collaborate with engineering to deliver secure, technically sound products aligned with best practices.
• Monitor industry trends and competitors to inform product direction and strategy.
• Lead the shift to probabilistic product experiences, balancing user experience with security and reliability.
• Support sales and pre-sales activities, and gather feedback from internal and external stakeholders to refine enhancements.

What You’ll Bring

• Self-reliant leader and team player, with a “let’s do this” approach
• Bachelor's degree in Computer Science, Information Systems, Engineering, Business, or related field.
• 4+ years of proven product management experience in identity management or security SaaS platforms.
• Experience with PM AI tools, LLM prototyping and prompt engineering.
• Fluency in the modern AI stack, demonstrable experience building or integrating AI/ML-powered features.
• Technical background in Identity Security, Identity Access Management, Privileged Access Management, Identity Threat Detection and Response, Cloud Infrastructure, Cloud Security Management, Cloud Infrastructure Entitlements Management, or related discipline.
• Relevant military experience is considered an advantage.
• Experience with public cloud computing, e.g. Azure, AWS, Google Cloud Platform
• Experience with Agile methodologies and a track record of delivering results in a fast-paced environment, specifically within the Software Development Lifecycle (SDLC)
• Excellent written, verbal, and presentation English communication skills, effectively contributing within an international corporate setting
• Demonstrates strong organizational skills by effectively multitasking and prioritizing responsibilities, maintains a professional demeanor at all times, and consistently supports and adheres to the Company’s Core Values.
• Have a passion for design and good UX
• Willingness to travel (not often, but we would need someone open to it when or if it is ever needed)

Better Together

Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.

We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.

About Us

BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.

BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.

Learn more at www.beyondtrust.com. 

#LI-BS1

BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.

Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.

The Role

BeyondTrust is a global leader in privileged access management. Our products provide remote access and privileged control capabilities that are deployed across thousands of enterprise environments worldwide. That makes us a high-value target. Nation-state actors, ransomware operators, and sophisticated threat groups actively target companies like ours—not just to compromise our corporate environment, but to reach the customers who trust our software to protect their most sensitive systems. A compromise of BeyondTrust is a compromise of the privileged access layer inside our customers’ networks. We take that responsibility seriously.

As a SOC Analyst on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on. You will monitor, investigate, and respond to security events in an environment where the stakes are real and the adversaries are capable. You will work alongside experienced threat hunters, incident responders, and detection engineers in a collaborative team that values sharp analytical thinking over checkbox compliance.

This team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and to contribute to how we integrate these capabilities into our detection, triage, and response workflows. We are not looking for people who are waiting to be told what to do—we are looking for people who want to build something.

What You’ll Do

Alert Triage & Monitoring 

• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.
• Investigate alerts to determine scope, severity, and whether escalation is warranted.
• Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.
• Classify, document, and track alerts through the full lifecycle using ticketing and case management systems.

Incident Response & Investigation 

• Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.
• Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure.
• Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows.
• Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.
• Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.

Detection Engineering & Threat Intelligence 

• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps.
• Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors.
• Help maintain and evolve detection coverage mapped to MITRE ATT&CK.
• Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts.

AI Integration & Automation 

• Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.
• Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows.
• Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort.
• Partner with engineering teams to improve log ingestion, data quality, and tool integrations.

Operational Excellence 

• Maintain daily operational notes and shift handoff documentation.
• Contribute to and refine IR runbooks, playbooks, and standard operating procedures.
• Participate in on-call rotation for after-hours incident escalation.
• Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities.
• Participate in tabletop exercises, purple team activities, and post-incident reviews. 

What You’ll Bring

• 2+ years of experience in a SOC, security operations, or incident response role.
• Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior.
• Experience with at least one SIEM platform and familiarity with writing search or detection queries.
• Familiarity with EDR platforms and cloud environments (IaaS preferred).
• Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows.
• Strong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences.

Nice To Have

• Experience leading or co-leading complex incident response engagements from triage through remediation.
• Experience with identity and access management platforms and cloud security posture management tools.
• Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows.
• Familiarity with SOAR platforms or orchestration tools for automated response and enrichment.
• Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines.
• Understanding of the privileged access management landscape and the threat actors that target it.
• Track record of evaluating and adopting emerging technologies in a production security environment.

Better Together

Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.

We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.

About Us

BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.

BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.

Learn more at www.beyondtrust.com. 

#LI-DF1