Senior Information Security Specialist

Location: Herzliya (IL)

Experience Level: Senior

Description

We are seeking an experienced, hands-on Senior Information Security Specialist to join our Global IT & Cyber department. The role designs, implements, operates and continuously improves security controls across on-premises data centers and cloud environments, with a strong focus on asset protection, operational resilience and regulatory compliance in a global financial environment.

Responsibilities

• Global Infrastructure & SOC Operations

• Secure AvaTrade's global infrastructure (on-premises and cloud)

• Improve and support SOC operations, detection workflows and incident response

• Operate and continuously enhance IT and cybersecurity tools and platforms

• Collaborate with IT, DevOps and Security teams to ensure alignment with ITGC and security best practices

Security Engineering

• Configure, troubleshoot and maintain security solutions, including:

o Firewalls (FortiGate)

o Web Application Firewalls (WAF)

o Network Access Control (NAC)

o Endpoint security platforms

o Mail gateways

o DLP solutions

o DDoS protection services

o AI security controls (AI gateway, DLP for AI prompts, AI usage monitoring)

Linux & Windows System Security

• Perform OS-level security hardening, patching and configuration management

• Troubleshoot security-related system incidents

• Ensure OS configurations align with internal security baselines and compliance standards

AWS Cloud Security & Governance

• Implement and maintain AWS Identity & Access hardening:

o IAM roles, policies and least-privilege access

o IAM Identity Center (SSO) with MFA

o IAM Access Analyzer

• Manage AWS Organizations and Service Control Policies (SCPs)

• Operate AWS Config for compliance and drift detection

Logging, Detection & Monitoring

• Operate and enhance security monitoring and detection services (GuardDuty)

• Centralize security logs and alerts using CloudWatch, EventBridge and S3

• Ensure full traceability of security-relevant events across cloud and on-prem environments

Microsoft Defender XDR

• Operate and tune the Microsoft Defender XDR suite:

o Defender for Endpoint (EDR, attack surface reduction, device isolation)

o Defender for Office 365 (phishing, safe links and attachments)

o Defender for Identity and Defender for Cloud Apps

o Defender for Cloud (posture management across Azure, AWS and multi-cloud)

• Triage and investigate Defender incidents and alerts, and run advanced hunting with KQL

• Drive remediation through Defender Vulnerability Management and Secure Score

Mobile & Endpoint Device Management (MDM)

• Manage Windows, macOS, iOS and Android devices with Microsoft Intune

• Enforce device compliance policies tied to Entra ID Conditional Access

• Manage device enrollment (Windows Autopilot, Apple Business Manager)

• Enforce disk encryption (BitLocker, FileVault), OS update rings and security baselines

• Protect corporate data on BYOD devices with app protection policies (MAM)

• Handle lost or compromised devices: remote lock, wipe and retire

Data Protection & Cloud Protection

• Enforce data protection and encryption using AWS KMS, Secrets Manager and ACM

• Operate Route 53 DNS logging and Route 53 Resolver DNS Firewall

• Enable VPC Flow Logs

• Implement AWS WAF and DDoS protection mechanisms

Infrastructure as Code, Vulnerability & Compliance

• Implement Infrastructure as Code (IaC) using Terraform

• Use Git-based workflows for infrastructure and security configuration

• Enforce policy-as-code, peer review and auditable change control

• Maintain vulnerability management processes and ensure continuous remediation

• Contribute to security policies, procedures and audit documentation

Security Automation & AI Agents

• Design, build and maintain AI agents that support daily security operations: alert triage, incident enrichment and investigation, vulnerability prioritization and compliance reporting

• Integrate agents with security platforms (Defender, Intune, FortiGate, AWS/OCI, SIEM) through their APIs

• Ensure agents run securely: least-privilege access, human approval for impactful actions, full logging and audit trail

Requirements

• Mandatory

• Minimum 4 years of hands-on Linux and Windows OS system administration experience

• Hands-on experience with firewalls (FortiGate)

• Experience with Web Application Firewalls (WAF)

• Experience with Network Access Control (NAC)

• Experience with security monitoring tools and SOC operations

• Hands-on experience with AWS security services:

o IAM

o AWS Organizations

o AWS Config

o CloudTrail

• Fortinet NSE4 or NSE5 (minimum)

• High-level English, written and verbal, for work with global teams, vendors and auditors

Advantage

• Oracle Cloud Infrastructure (OCI) IAM experience – IAM policies, compartments, Identity Domains, dynamic groups and least-privilege access

• Hands-on Microsoft Defender XDR experience (Endpoint, Office 365, Identity, Cloud Apps, Cloud), including KQL advanced hunting

• MDM experience with Microsoft Intune – compliance, Conditional Access, Autopilot, app protection policies

• Experience building AI agents that automate day-to-day security work (alert triage, investigation, reporting, remediation workflows), using LLM APIs and agent frameworks with Python

• Higher-level Fortinet certification (NSE6 / NSE7)

• Azure security experience

• Advanced Terraform experience

• Scripting (Python, Bash, PowerShell)

• Penetration testing knowledge

• Experience supporting audits and regulatory compliance