Senior Detection & Response Engineer

Description

The company is hiring a Senior Detection & Response Engineer for its Security Operations team.

You will help raise the company's ability to detect and respond to threats through detection engineering, security automation and improvements to day-to-day operations.

The team runs a hybrid Security Operations Center (SOC). You will work with Security Operations, Security Engineering, MSSP partners and other technical teams to find, investigate and respond to security threats faster.

This is a hybrid role. You will need to be onsite at the Kraków office three days per week.

Responsibilities

• Build, tune and maintain detections, correlation rules, analytics, searches and threat detection content across SIEM, EDR, identity, email, SaaS and security monitoring platforms.
• Find gaps in detection coverage and create new use cases to close them.
• Cut false positives and raise alert quality.
• Map detections and use cases to attacker techniques and frameworks such as MITRE ATT&CK.
• Design, build and maintain security automation workflows in Tines and other approved automation platforms.
• Build integrations using APIs, workflow tools and native platform features.
• Automate repetitive operational tasks to speed up investigation and response.
• Look for ways to simplify security processes through automation on an ongoing basis.
• Support investigations and response work with detections, automation and technical analysis.
• Work with threat analysts, MSSP partners and incident responders to make operations more effective.
• Help improve detection, investigation and response speed.
• Measure and improve how well detections, automations and workflows perform.
• Work with Security Operations, Security Engineering, IT and Product Security to strengthen detection and response.
• Assess and adopt new technologies that make analysts and operations more efficient.
• Help keep evolving the company's Security Operations program.

Requirements

• Experience improving threat detection, security operations, incident response or related cybersecurity capabilities in a production environment.
• Hands-on experience in detection engineering.
• Strong ability to build, tune and maintain detections, searches, analytics or threat hunting content in security query languages.
• Experience building and maintaining security automations with Tines, SOAR platforms or similar workflow tools.
• Experience designing, building or maintaining automation workflows, not only running ones that already exist.
• Experience integrating systems through APIs, automation platforms or native platform features.
• Solid understanding of threat detection, security investigations and incident response at Tier 3 level.
• Ability to turn operational problems into scalable detections, automations and workflow improvements.
• Strong collaboration skills and experience working across Security Operations, Engineering, IT and MSSP environments.
• Success in this role means owning and improving detection content and security analytics, expanding detection coverage across the environment, cutting manual work through automation, supporting Security Operations teams with effective detections and workflows, delivering measurable gains in detection and response, and acting as a senior technical contributor to the function.

Conditions

Pay is based on your skills, experience, qualifications and location, and reflects a pay-for-performance approach that rewards individual impact.

Specific pay and benefits for this role will be discussed during recruitment.

Final content, role requirements and hiring decisions are subject to human review and approval by the company.

Benefits

• Possible annual bonuses and incentives.
• Possible health and wellbeing benefits, paid time off, retirement plans and insurance cover.
• Other local or statutory benefits, depending on role and location.