{"id":1438647,"url":"https://alion.io/job/allegro-mid-cybersecurity-engineer-csirt","title":"Mid Cybersecurity Engineer - CSIRT","company":{"id":1876195,"name":"Allegro","domain":"allegro.eu","url":"https://alion.io/company/allegro-eu","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Poznań, Poland"],"countries":["PL"],"hiring_countries":["PL"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":44000,"max_usd":92000,"period":"year","method":"role_country_seniority_unknown","sample_n":155},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Debian","optional":false},{"name":"DHCP","optional":false},{"name":"DNS","optional":false},{"name":"Linux","optional":false},{"name":"Machine Learning","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Ubuntu","optional":false},{"name":"VPN","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-22T00:00:00Z","employer_posted_date":"2026-09-22","last_verified_at":"2026-10-22T19:23:19Z","board_verified":true,"closed_at":null,"days_open":30,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":30},"description":"Join the Cybersecurity team! You will have a unique chance to safeguard one of the most visible and high-scale platforms in the region. High performance, engineering best practices, and a great atmosphere in the team guaranteed!\nImportant things for you\nFlexible working hours in the hybrid model (4/1) - working hours start between 7:00 a.m. and 9:00 a.m. We also have 30 days of occasional remote work.\n\nAnnual bonus based on your annual performance and company results.\n\nOur team is based in Warsaw, Poznań and Toruń.\n\nAbout the job\nMassive Scale & Security Challenges: Secure and optimize a world-class, cloud and on-prem environment handling thousands of requests per minute. This is high-availability, high-performance security engineering in practice.\n\nModern Tech Stack: Work within an advanced ecosystem where core technologies include specialized defensive and incident response security tools, automated SOAR playbooks, EDR/XDR systems, modern SIEM systems for logging, correlations and machine learning detection models, AI based security incident response agents.\n\nTrue Ownership & Autonomy: We live by a \"you build it, you run it\" philosophy. You'll join an autonomous team with full ownership of your security services - from threat intelligence and hunting, EDR, SOAR, SIEM technologies to deploying custom incident response assistants.\n\nComplex Architectural Puzzles: From securing distributed systems to tackling novel AI vulnerabilities, you'll solve complex engineering problems that directly protect a massive, real-time marketplace.\n\nSkills required\nHave experience working in SOC, CERT or CSIRT teams\n\nHave experience using SOAR, EDR/XDR and SIEM systems\n\nPossess and continuously develop knowledge of current offensive and defensive security threats\n\nHave hands-on experience working with modern, large-scale IT infrastructure and understand DevOps culture\n\nAre familiar with the Linux systems (Ubuntu/Debian), Windows and MacOS\n\nHave designed, implemented, developed, or maintained solutions that enhance security\n\nHave participated in security incidents handling\n\nCan communicate and collaborate effectively with people from different areas and levels of the organization\n\nUnderstand the importance of IT security technologies, tools, and procedures, and their impact on the business\n\nDemonstrate high independence and a self-driven approach - you are capable of taking full, end-to-end incident response process, from investigation, evidence and log collection to final reporting and remediation guidance\n\nAre keen on leveraging automation and AI-assisted techniques to improve incident response, detection rules tuning and innovate defensive techniques.\n\nAre open to developing soft skills and embracing a growth mindset through active participation in team retrospectives and cross-team collaborations;\n\nAre excited about adopting and securing AI technologies, being ready to incorporate AI coding and security assistants into their daily work to maximize efficiency;\n\nWant to constantly develop and update their knowledge in a rapidly shifting threat landscape;\n\nKnow English at at least B2 level.\n\nYour main responsibilities:\nMonitor and triage security incidents generated by EDR/XDR, SIEM and other detection platforms to identify true positive incidents in real time, 24/7 on-call rotation.\n\nInvestigate and respond to endpoint and server threats such as malicious behavior on corporate workstations and servers.\n\nAnalyze and mitigate phishing campaigns targeting Allegro brands (Allegro, Allegro Lokalnie, AllegroPay) - identifying malicious domains impersonating the company, coordinating takedown requests, and enriching related IOCs.\n\nDetects and responds to network-layer attacks, including DDoS attempts, password spraying, abnormal BOT scanning.\n\nPerform digital forensics and log correlation across multiple data sources (Active Directory sign-ins, endpoint and server logs, proxy, DNS, VPN, DHCP logs) to reconstruct attack timelines and root cause.\n\nEnrich and correlate Indicators of Compromise (IPs, domains, hashes, URLs) using threat intelligence platforms and internal asset inventories to assess scope and impact.\n\nInvestigate identity-related risks, such as suspected account takeovers, impersonation, and anomalous user behavior flagged by identity protection tools.\n\nDocument findings and produce evidence-based incident reports, including root cause analysis, MITRE ATT&CK mapping, and remediation recommendations for stakeholders and asset owners.\n\nCoordinate remediation actions with IT, infrastructure, and business teams (e.g. account lockouts, endpoint isolation, credential resets, domain blocking).\n\nContinuously improve detection capabilities by tuning correlation rules, updating threat intelligence, and identifying gaps based on recurring incident patterns.\n\nCollaborate with brand protection and external partners to detect and respond to threats against Allegro's reputation and customers.\n\nWhat's in it for you:\nWell-located offices (with e.g. fully equipped kitchens, bicycle parking, terraces full of greenery) and excellent work tools (e.g., raised desks, ergonomic chairs, interactive conference rooms).\n\nA 16\" or 14\" MacBook Pro or corresponding Dell with Windows (if you don't like Macs) and all the necessary accessories.\n\nA wide selection of fringe benefits in a cafeteria plan - you choose what you like (e.g., medical, sports or lunch packages, insurance, purchase vouchers).\n\nEnglish classes that we pay for related to the specific nature of your job.\n\nA training budget, inter-team tourism (see more here), hackathons, and an internal learning platform where you will find multiple trainings.\n\nAn additional day off for volunteering, which you can use alone, with a team, or with a larger group of people connected by a common goal.\n\nSocial events for Allegro people - Spin Kilometers, Family Day, Fat Thursday, Advent of Code, and many other occasions we enjoy.\n\nAnd that's just the beginning! You can read more about the benefits here.\n#goodtobehere means that:\nYou will join a team you can count on - we work with top-class specialists who have knowledge- and experience-sharing in their DNA.\n\nYou will love our level of autonomy in team organization, the space for continuous development, and the opportunity to try new things. You get to choose which technology solves the problem and you are responsible for what you create.\n\nYou will be equipped with modern AI tools to automate repetitive tasks, allowing you to focus on analyzing complex threats, developing advanced security automation, and refining secure architectures.\n\nYou will meet the Allegro Scale, which starts with over 1000 microservices, an open-source data bus (Hermes) with 300K+ rps, a Service Mesh with 1M+ rps, tens of petabytes of data, and production-used machine learning.\n\nYou will become part of Allegro Tech - We speak at industry conferences, cooperate with tech communities, run our own blog (it's been over 10 years!), record podcasts, lead guilds, and we organize our own internal conference - the Allegro Tech Meeting. We create solutions we love (and can) to talk about!\n\nSend us your CV and… see you at Allegro!","description_format":"text","description_chars":7180,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":["Apple Macbook","Cafeteria","Flexible schedule"],"hiring_locations":[{"name":"Poland","iso":"PL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Marketplaces"],"lifecycle":[{"event":"open","at":"2026-09-29T04:13:31Z"}],"visa":[],"liveness":{"score":29,"band":"fade","label":"Fading","p_open":1,"p_active":0.65,"p_room":0.44,"age_days":30,"expected_fill_days":25,"reasons":["conf:0","velocity","win:tail","crowd:brand,attention"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/allegro-mid-cybersecurity-engineer-csirt","json_url":"https://alion.io/job/allegro-mid-cybersecurity-engineer-csirt.json","meta":{"generated_at":"2026-10-22T23:46:40Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9832,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1876195},"rest":"https://alion.io/mcp/rest/get_company?id=1876195"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fallegro-mid-cybersecurity-engineer-csirt"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fallegro-mid-cybersecurity-engineer-csirt"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fallegro-mid-cybersecurity-engineer-csirt"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/allegro-mid-cybersecurity-engineer-csirt\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fallegro-mid-cybersecurity-engineer-csirt"}]}