Senior SOC Analyst - Vehicle & API Security

Upstream Security protects connected vehicles, mobility services, and their supporting digital ecosystems. Our AI-powered cybersecurity platform combines vehicle security, API security, threat intelligence, detection and response, and managed SOC services.

We are looking for a Senior SOC Analyst to join Upstream’s managed cybersecurity services team. You will investigate and respond to cybersecurity incidents involving connected vehicles, mobility applications, backend services, and APIs.

As a senior analyst, you will serve as a security focal point for customers, lead complex investigations, improve detection capabilities, and help deploy and maintain agentic AI workflows used across SOC operations.

This is a full-time, hybrid position based in Herzliya, Israel.

Requirements:

• 3+ years of experience in SOC operations, incident response, threat hunting, or security investigations.

- Previous customer facing analyst role, preferably within MSSP, consulting, or professional services context, preferably in English - Strong practical understanding of APIs, including REST, authentication, authorization, OAuth, and JWT. - Hands-on API security experience with technologies such as WAFs, API gateways, API security platforms, SIEM, Burp Suite, or similar tools. - Experience investigating common API threats, including account abuse, authorization flaws, injection, data exposure, and business-logic attacks. - Experience with SIEM, SOAR, XDR, security automation, and large-scale data analysis. - Experience deploying or maintaining automation, AI-assisted, or agentic AI workflows. - Scripting experience, preferably with Python or SQL. - Ability to lead complex investigations and operate effectively in high-pressure environments. - Fluent English. - Willingness to participate in a rotating on-call schedule. - Experience in automotive, mobility, IoT, cloud security, mobile application security, or managed security services is preferred.

Responsibilities:

• Monitor, investigate, and respond to vehicle and API security alerts.

- Lead complex investigations, assess impact, identify root causes, and provide actionable mitigation recommendations. - Analyze suspicious vehicle behavior, API activity, authentication events, and mobility-related telemetry. - Investigate API threats including authorization abuse, credential attacks, injection, data exposure, automation, and business-logic abuse. - Deploy, configure, test, and maintain agentic AI workflows supporting alert triage, investigations, threat hunting, reporting, and response. - Monitor the accuracy, reliability, and operational performance of AI-driven workflows and continuously improve their prompts, tools, guardrails, and decision logic. - Conduct proactive threat hunting and OSINT investigations to identify emerging threats and attack patterns. - Develop and maintain investigation playbooks, operational procedures, and response processes. - Tune detection logic, behavioral profiles, and machine-learning models to improve detection quality and reduce false positives. - Produce clear investigation reports, incident updates, dashboards, and executive-level summaries. - Act as a trusted security advisor to customers during investigations, workshops, and business reviews. - Mentor analysts and promote consistent investigation quality across the SOC. - Track operational performance against SLAs, quality standards, and SOC KPIs. - Collaborate with threat intelligence, research, product, engineering, and customer-facing teams to improve Upstream’s security capabilities. - Participate in the team’s rotating on-call schedule and provide timely support for urgent security incidents when required.