Dec 2022 – Mar 2025 · 2 yrs 3 mos · Israel · Hybrid

• Led the xTriage Team, a specialized division focused on offensive security, adversarial AI research, and advanced incident response across Microsoft 365, Azure, AWS, and hybrid infrastructures. My role combined red team operations, Cloud and AI research, and deep cloud forensics to simulate real world adversaries and enhance organizational detection and resilience.
• Collaborating with data science and engineering teams, I helped shape the foundation of AI-SOC architectures, fusing human expertise with machine intelligence to automate investigation workflows, strengthen threat correlation, and uncover attacker patterns invisible to traditional systems.
• Directed and executed AI augmented attack simulations targeting identity systems, tokens, and LLM integrated services to expose emerging vulnerabilities. Designed and implemented SIEM detection logic, playbooks, and behavioral analytics to transform offensive findings into defensive capabilities.
• Through continuous AI adversarial testing, red team insights, and cross-team collaboration, xTriage evolved into a hybrid human AI security powerhouse, merging proactive offense with adaptive defense to redefine how modern SOCs anticipate, detect, and counter advanced threats.

Jun 2021 – Sep 2022 · 1 yr 3 mos · United States

• Directed cybersecurity architecture and global incident response operations during a high growth phase, integrating threat intelligence, red team simulation, and automated defense into a unified security strategy. My work combined offensive research, cloud-native architecture design, and AI-driven incident response pipelines, enabling rapid detection, containment, and recovery across large-scale enterprise environments.
• Built and implemented an incident response and recovery framework, powered by cloud forensics, behavioral analytics, and threat intelligence fusion to counter modern intrusion patterns. Conducted investigations and applied adversarial insights to enhance detection accuracy and defensive readiness continuously.
• Worked closely with engineering, compliance, and executive leadership to create a unified security architecture that blended operational agility with AI innovation. This transformation transformed incident response from a reactive function into an intelligence, offensive security capability capable of predicting and neutralizing complex threats in real-time.

Dec 2020 – Jun 2021 · 6 mos · Israel

• Led cloud security architecture, incident response, and offensive testing across Microsoft 365 and Azure environments. Designed and implemented cloud security programs using CSPM, CWPP, and CNAPP technologies to improve visibility, reduce exposure, and strengthen zero trust adoption.
• Built a Microsoft Sentinel based SOC and engineered detections across the full kill chain using KQL analytics, custom playbooks, and automated response frameworks. Conducted offensive simulations and attack emulations targeting identity, data, and compliance layers to test resilience and raise detection maturity.
• Developed cloud incident response automation aligned with MITRE ATT&CK and Cyber Kill Chain methodologies to accelerate investigation and containment. Performed deep penetration testing and adversarial exercises against cloud and hybrid environments to uncover vulnerabilities and improve readiness.
• Collaborated with Microsoft engineering teams, compliance officers, and customers to architect secure cloud solutions, deliver workshops, and improve operational maturity. This role strengthened the foundation of modern cloud security operations by combining red team insights with proactive detection engineering to stay ahead of evolving threats.

Apr 2019 – Dec 2020 · 1 yr 8 mos · Israel

• Led global cloud security initiatives across Azure and AWS environments, improving security posture and ensuring compliance with corporate and regulatory standards. Designed and implemented scalable security architectures for multi-cloud workloads with a focus on identity, access control, and continuous monitoring.
• Deployed Microsoft 365 Security and Azure native technologies to enhance threat detection and automate response processes. Conducted offensive assessments and simulated attack scenarios on cloud and hybrid environments to identify weaknesses and strengthen defensive controls.
• Developed and enforced security policies and governance models to protect data and critical workloads. Integrated threat intelligence feeds with SIEM and SOAR solutions to provide real-time enrichment and accelerate investigation workflows.
• Performed threat hunting and vulnerability assessments targeting identity, network, and application layers. Analyzed attacker tactics and techniques to inform defensive strategy and improve resilience against advanced threats.
• This role established a new methodology for adopting and operationalizing cloud security across the organization, transforming Netafim’s defensive posture into a proactive, intelligence-informed security program.

Jan 2018 – Apr 2019 · 1 yr 3 mos · Israel

• Led the company’s technology and cybersecurity strategy with a focus on cloud security, incident response, and advanced threat defense. Designed and executed enterprise scale Microsoft and Azure security projects that improved the organization’s resilience, detection accuracy, and operational maturity.
• Conducted in-depth cloud security assessments to identify vulnerabilities and design targeted mitigation strategies. Simulated real attack scenarios against Azure and Microsoft 365 environments to validate defenses and strengthen response mechanisms.
• Developed and deployed a cloud incident response framework aligned with MITRE ATT&CK and Cyber Kill Chain methodologies. Automated response workflows to improve consistency, reduce investigation time, and ensure rapid containment of security incidents.
• Architected secure cloud infrastructure and deployment models for complex workloads across Azure and hybrid environments. Delivered strategic guidance to executive stakeholders, ensuring technology alignment with business and security priorities.

May 2016 – Dec 2017 · 1 yr 7 mos · Israel

• Led cybersecurity initiatives focused on strengthening enterprise cloud and identity security across Microsoft 365 and Azure environments. Directed vulnerability assessments, penetration testing, and offensive simulations targeting email, identity, and collaboration systems to expose weaknesses and improve defensive maturity.
• Developed and implemented tailored security architectures for enterprise customers, aligning with compliance and operational requirements. Conducted in-depth assessments and hardening of Active Directory, Office 365, and hybrid identity infrastructures to reduce exposure and enforce least privilege principles.
• Designed and deployed Microsoft and Azure security technologies, including Defender for Cloud, Defender for Endpoint, and Advanced Threat Protection, to improve visibility and automate detection workflows. Delivered customized detection and response logic to enhance SOC capabilities and accelerate incident investigation.
• Provided security guidance, technical mentorship, and hands-on leadership for customer engagements, ensuring best practices in cloud security, data protection, and identity governance. This role built the foundation for a unified, proactive defense strategy across cloud and hybrid environments through a balance of offensive insight and operational precision.

Mar 2014 – Apr 2016 · 2 yrs 1 mo · Israel

• Designed and implemented robust Microsoft Hybrid Identity solutions, ensuring seamless integration and secure access across on-premises and cloud environments.
• Architected and deployed comprehensive identity solutions tailored to meet organizational security and compliance requirements.
• Established security baselines for multi-cloud and hybrid identity environments, aligning with industry best practices and regulatory standards.
• Delivered impactful knowledge transfer sessions, including chalk talks, seminars, workshops, and training courses, to enhance team capabilities and understanding.
• Developed custom PowerShell-based solutions to address unique customer needs, automating workflows and improving efficiency.
• Diagnosed and resolved complex performance, connectivity, and operational issues within Office 365 environments, ensuring optimal system performance.

Apr 2012 – Feb 2014 · 1 yr 10 mos · Herzliya, Israel

• Designed and implemented Exchange, Office365, Lync, and PKI platforms.
• Customer advisory and integrity person for Enterprise and mid-level customers
• Experience with hands-on activities from troubleshooting to Microsoft projects deployment
• Wrote design and plan documents, including low-level project documents
• Transferred knowledge, including a workshop for Office 365 on a weekly basis
• Did many hardening for Active Directory and windows client
• Performed many operations of analyzing infrastructure problems in on-premises and cloud environments

May 2008 – Mar 2012 · 3 yrs 10 mos

• Managed and led professional service s team - technically and administrative
• Developed support procedures, framework, and technical chain
• Supported Microsoft technologies, including Office 365
• Created a Blackberry support site for Partner customers.
• Made Mobile device hardening as part of Blackberry support
• Trained many teams inside Partner and customers.

Jan 2004 – Mar 2008 · 4 yrs 2 mos

• Migrated Microsoft Exchange to the latest version at the enterprise customer
• Experience with virtualization projects with Hyper-V for a mid-level customer
• Did many Active Directory migration projects
• Trained customers, IT teams, and technical customers
• Did many hardening for Active Directory and windows client
• Performed many operations of analyzing infrastructure problems in on-premises and cloud environments

Jun 2000 – Dec 2003 · 3 yrs 6 mos

• Managed Exchange Server and Active Directory environment
• Part of the Hotmail Israel team and did many Exchange activities.
• Experience with an upgrade of IIS servers for MSN sites
• Migrated from NT 4.0 to Windows Server 2003 environment with Active Directory servers
• Migrated of email server environment from Exchange 5.5 to Exchange 2003
• Did many hardening for Active Directory, Microsoft PKI, and windows client
• Performed many operations of analyzing infrastructure problems in on-premises and cloud environments