Ory Yaffe Mordechai
Verified Expert in Engineering
Security Engineer and Developer
Kiryat Ono, Israel
Toptal member since July 22, 2026
Ory is a security operations lead with six years of experience in enterprise environments, including AmitimTech and Cymulate. He specializes in detection strategy, threat hunting, and high-stakes incident response across technology and financial sectors. Combining deep SOC expertise with modern AI capabilities, Ory designs agentic workflows and automation solutions that improve detection accuracy and accelerate response times.
Portfolio
Experience
- Detection Engineering - 6 years
- SIEM - 6 years
- Security Incident Triage - 6 years
- Cyber Threat Hunting - 3 years
- Cyber Threat Intelligence (CTI) - 3 years
- CI/CD Pipelines - 3 years
- Vulnerability Scanning - 3 years
- Security Orchestration, Automation, and Response (SOAR) - 3 years
Preferred Environment
Detection Engineering, SIEM, Security Orchestration, Automation, and Response (SOAR), Threat Intelligence, Retrieval-augmented Generation (RAG), Artificial Intelligence (AI), Cyber Defense, LangChain, Agentic AI, AI Security
The most amazing...
...project I've delivered combines Tier-3 analysis, SOAR automation, and AI-driven detection improvements that streamlined accuracy across multiple platforms.
Work Experience
Tier 3 Security Specialist
Cymulate
- Guided Tier 3 technical investigations across customer environments to analyze detection behavior, validation outcomes, and platform-related issues.
- Performed deep root-cause analysis (RCA) on complex security validation scenarios involving telemetry, integrations, and simulation execution.
- Worked directly with R&D to identify product-level gaps, clarify technical findings, and support improvements in platform accuracy and validation logic.
- Analyzed integrations with security platforms, including Cortex XDR, CrowdStrike, Defender, and similar environments to understand data flow, mapping gaps, and validation inconsistencies.
- Facilitated technical discussions with customer security teams to review findings, explain validation results, and support troubleshooting of complex enterprise scenarios.
Security Operations Technical Lead
Opal Future Technologies
- Served as the internal technical lead for the organization's security operations program, overseeing external MSSP, SIEM, incident response, and threat intelligence providers in an enterprise environment supporting 500 to 2,000 employees.
- Performed Tier 2 and Tier 3 alert investigations, analyzing complex security events, conducting forensic triage, and delivering actionable findings and response recommendations.
- Served as the sole incident response focal point during confirmed security events, coordinating forensic triage, impact assessment, and external incident response engagement.
- Defined detection strategy and led the development of new SIEM rules and use cases in collaboration with the external MSSP SIEM team, including onboarding new systems into monitoring coverage.
- Managed SLAs and performance of external security vendors, conducting operational reviews and continuous improvement of alert quality and response workflows.
- Served as the organizational liaison with the threat intelligence provider, operationalizing IOC feeds across monitoring and blocking systems via an automated ingestion pipeline.
- Operated Nessus vulnerability scanning and managed Armis security policies, supporting asset visibility and exposure reduction.
- Drove penetration testing processes, coordinating findings and tracking remediation through to completion.
- Architected Microsoft Defender for Cloud monitoring across Azure and Microsoft 365, establishing cloud security visibility.
- Designed SOAR automation use cases, laying the foundation for future AI-assisted security workflows.
Senior Cybersecurity Analyst
Ness Technologies
- Conducted threat hunting and complex security investigations across multi-vendor environments, including Microsoft Sentinel, Google Chronicle, CrowdStrike, Microsoft Defender, and Carbon Black.
- Analyzed alerts, telemetry, and detection behavior across client environments to support investigation quality and improve incident visibility.
- Performed cross-platform investigation and triage of suspicious activity, malicious indicators, and potential threat scenarios in MSSP environments.
- Provided technical audit findings and rule-tuning recommendations to strengthen detection quality and improve customer security posture.
- Worked across multiple security stacks and customer environments to support investigation consistency and detection effectiveness.
Cybersecurity Analyst
Matrix 2Bsecure
- Monitored and investigated security events across enterprise environments as part of hands-on SOC operations.
- Performed alert triage and analysis of suspicious files, malicious URLs, and security-related activity.
- Worked with enterprise security controls, including NAC, WAF, and DLP, to support threat visibility and incident investigation.
- Supported security monitoring across the financial sector and global infrastructure environments.
Experience
Automated Threat Intelligence Remediation Pipeline with Splunk SOAR
I designed and implemented an automated end-to-end playbook in Splunk SOAR that ingested the external threat intelligence feeds, parsed and normalized indicators of compromise (IoCs), enriched them with additional context, applied validation logic, and automatically executed blocking actions across network and endpoint security controls. The solution included full audit logging and controlled escalation paths for high-impact indicators.
This automation drastically reduced mean time to respond (MTTR) and eliminated the need for manual analyst intervention on this class of threats.
Security Findings Agent: Agentic AI for Security Operations
https://github.com/oryaffe/SecurityFindingsAgentThe system enables authenticated users to investigate asset-specific findings through web chat or CLI, retrieve organizational hardening policies using local RAG, review asset, scan, and patch history, receive policy-grounded remediation guidance, and create and track remediation tickets.
At its core is an agentic loop combining an LLM, MCP tools, and conversation memory. I implemented the solution in Python, including FastAPI and WebSocket interfaces, ChromaDB vector search, SQLite persistence, bcrypt and JWT authentication, ownership-scoped authorization, guardrails, and deterministic response validation for critical output and policy rules.
I tested the application with synthetic operational data and sample policies, deployed it locally and to an Ubuntu instance on AWS EC2, and produced architecture, security, deployment, and validation documentation. Developed as my AI Engineering capstone, the project combines my security operations experience with hands-on AI engineering.
Certifications
AI Engineer Course
DevOps Experts College
Artificial Intelligence Implementation
Horizon College
Microsoft Certified: Azure Fundamentals
Microsoft
Certified Hands-on Cybersecurity Specialist
KERNELiOS
Certified Ethical Hacker (CEH)
EC-Council
Cybersecurity and Ethical Hacking
HackerU
Certified Network Associate Routing and Switching (CCNA)
Cisco
Skills
Tools
IBM QRadar, Nessus, Splunk SOAR, iReport, AI Prompts
Languages
Python, SQL
Paradigms
Security Orchestration, Automation, and Response (SOAR), Model Context Protocol (MCP)
Platforms
CrowdStrike, Azure, Varonis Data Security, Armis, Linux, Amazon Web Services (AWS), Google Cloud Platform (GCP)
Frameworks
LangGraph
Storage
SQLite
Other
Cortex XDR, SIEM, Cyber Defense, Security Incident Triage, Cyber Threat Hunting, Security, Vulnerability Management, Microsoft Defender Antivirus, Managed Security Service Providers (MSSP), Detection Engineering, Incident Response, Vendor Management, Web Application Firewall (WAF), Data Loss Prevention (DLP), Cyber Kill Chain, Cloud, Monitoring, Incident Handling, Artificial Intelligence (AI), Cyber Threat Intelligence (CTI), Vulnerability Scanning, Large Language Models (LLMs), Network Security, Endpoint Security, playbook development, AI Agents, Agentic AI, Agentic RAG Systems, Agentic Workflow Design, Vulnerability Remediation, Security Engineering, Vulnerability Assessment, Threat Intelligence, Microsoft Sentinel, Networking, Routing, Cisco Switches, CI/CD Pipelines, Snyk, Servers, Cyber Security & Ethical Hacking, Encryption, Patch Management, Machine Learning, Code Scanning, Repository Management, Sspm, Cspm, Wiz Cloud Security Platform, Splunk Enterprise Security, Guardium, Retrieval-augmented Generation (RAG), Indicators of Compromise (IoCs), APIs, RAG Pipelines, RAG Architecture, ChromaDB, Ethical Hacking, LangChain, AI Security, Cybersecurity Automation, AI Solutions, FastAPI, AI Pipeline, AI Workflow, Vector Data, Prompt Engineering, VECTOR DB, AI Engineering, Context Engineering, Vector Databases, AI Evaluation, LLM Observability, AI Guardrails, Automations, Kubernetes Security
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
Share your needs
Choose your talent
Start your risk-free talent trial
Top talent is in high demand.
Start hiring