{"id":2723465,"url":"https://alion.io/job/aviva-canada-cyber-response-technical-team-lead","title":"Cyber Response Technical Team Lead","company":{"id":1074183,"name":"Aviva Canada","domain":"aviva.ca","url":"https://alion.io/company/aviva-ca","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":96,"open_postings":6,"ghost_share":0,"stale_share":0.167,"repost_share":0,"time_to_fill_p50_days":37,"computed_at":"2026-10-25T05:49:26Z"}},"role":"Leadership","role_family":"Leadership","seniority":"lead","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Warsaw, Poland"],"countries":["PL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":73000,"max_usd":140000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":37},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Fine-tuning","optional":false},{"name":"Incident Management","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-16T15:38:00Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-25T03:38:13Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"Hi, we're glad you're here! We are hiring to our Aviva Services Excellence Centre! Take a look at our job description - maybe it suits you or one of your friends?\nAviva is looking for a Cyber Response Technical Team Lead to manage and develop a team of experienced Senior Cyber Security Analysts within our Global Security Operations Centre (GSOC).\nThis role is a combination of hands-on technical work and people leadership responsibility. You’ll develop an existing and high-performing team while remaining close to the action by responding to high severity and complex incidents together with your team.\nYou’ll work across Aviva’s cyber organisation to strengthen our response capabilities, improve how we respond to threats, and drive continuous improvement across processes, playbooks, automation, AI and technology.\nWhy join us?\nReady to take the next step in your cyber security leadership career? Join our Global Security Operations Centre (GSOC) and take responsibility for a team of experienced Senior Security Analysts protecting our organisation against evolving cyber threats.\nLead People, Stay Close to Cyber: Develop and grow an experienced team while remaining engaged in hands-on cyber incident response activities.\nIn-House Power: We run our security internally, giving you the opportunity to directly influence our people, operations and cyber defence capabilities.\nConstant Evolution: Drive improvements across incident response processes, automation and emerging technologies while staying close to the changing threat landscape.\nCyber - A Core Aviva Priority: Cyber security is deeply embedded across the business, with continued investment in our people and capabilities.\nMake an Impact: Help shape how our GSOC function evolves and how we protect Aviva from cyber threats.\nWhat will you be doing?\nLeading and managing a team of Senior Cyber Security Analysts/Incident Responders\nOwning team performance, engagement, development plans, and career progression.\nProviding coaching, mentoring, and technical leadership to enhance team capabilities and expertise.\nCoordinating day-to-day activities, workload prioritization, resource allocation, and team scheduling.\nManaging team capacity planning, on-call rotations, shift coverage, and operational readiness.\nActing as the primary GSOC escalation point for complex and high-severity cyber security incidents.\nLeading and supporting hands-on investigations, containment, eradication, and recovery activities during cyber incidents.\nProviding advanced technical guidance across endpoint, network, cloud, identity, and threat investigations.\nEnsuring high-quality incident response practices, investigation standards, and operational excellence.\nCoordinating incident response activities with internal stakeholders, customers, and other Cyber Security teams.\nDriving post-incident reviews from the GSOC perspective and ensuring lessons learned are translated into measurable improvements.\nIdentifying skill gaps and developing training, knowledge-sharing, and capability-building initiatives.\nSupporting recruitment, onboarding, succession planning, and retention of cyber security talent within GSOC.\nActing as a Subject Matter Expert (SME) in Cyber Security projects, strategic initiatives, and customer engagements.\nProviding expert input into the design, implementation, and enhancement of cyber security services and capabilities.\nDriving continuous improvement of incident response processes, fine-tuning of detection rules, playbooks, tooling, and operational procedures.\nChampioning automation initiatives to improve GSOC efficiency, investigation quality, and response times.\nDriving adoption and effective use of AI and emerging technologies across GSOC and other relevant areas where required.\nCollaborating with Detection Engineering, Cyber Incident Management, Threat Hunting, Threat Intelligence, Security Engineering, and Product teams to enhance cyber defence capabilities.\nStaying current with emerging threats, attacker techniques, and industry best practices to strengthen response capabilities.\nContributing to the strategic development and maturity of the organization's Cyber Response and Security Operations functions.\nWhat we’re looking for:\n6+ years of experience in Cyber Security, including significant hands-on experience in Security Operations, Incident Response, or DFIR.\nMinimum 2 years of proven people management experience, with direct responsibility for team performance, development, engagement, and career progression.\nDemonstrated experience managing and developing senior Cyber Security professionals, ideally within a SOC, CSIRT, Cyber Response or Incident Response function.\nProven experience in performance management, coaching, mentoring, development planning, and career progression.\nExperience managing team capacity, workload prioritisation, resource allocation, on-call rotations, and operational readiness.\nExtensive hands-on experience leading the response to complex and high-severity cyber security incidents, including investigation, containment, eradication and recovery.\nProven ability to act as a senior technical escalation point during major cyber security incidents and provide leadership under pressure.\nStrong technical expertise across multiple security domains, including endpoint, network, identity, cloud, SIEM/XDR, threat hunting and digital forensics.\nStrong understanding of MITRE ATT&CK, attacker TTPs and modern investigation methodologies.\nExperience developing and improving incident response playbooks, investigation standards, detection capabilities and operational procedures.\nExperience driving continuous improvement and automation within Security Operations, including the effective use of SOAR, AI and emerging technologies.\nStrong stakeholder management skills and experience working across multiple Cyber Security and Technology functions.\nAbility to communicate complex cyber security matters effectively to both technical and senior business stakeholders.\nFluent Polish and English, both spoken and written.\nExperience working in an international environment.\nNice to have:\nIndustry certifications such as GCIH, GCFA, GCFE, CISSP, OSCP or SC-200.\nExperience with KQL, PowerShell or Python and security automation.\nIn Aviva Services Excellence Centre, we provide:\nContract of employment \nPerformance Bonus \nPrivate medical care (ENEL-MED) \nCafeteria system of benefits (e.g. MultiSport card) \nAdditional parent privileges: - baby leave - 6 weeks leave for second parent - shortened working time after parental leave \nEmployer-funded group insurance \nEmployee Shares Plan \nExtra day off for birthday \nPaid time off to volunteer \nAdditional leave acquiredover the years in the company (even 5 days more in a year) \nWellbeing Leave - additional two weeks paid leave after 10 years of service \nPsychological support consultations \nAccess to the e-learning platforms \nInternal employee referral program \nHybrid working model from Poland with a few days in Warsaw office per month\nAttractive office location in Warsaw - Gdański Business Center \nAdditional entitlements for people with disabilities - Work Without Barriers \nWork environment that promotes diversity - Diversity Charter \nDo you see yourself in Aviva Services Excellence Centre? Be sure to apply!\nAviva is for everyone!\nWe’ve been ranked the #1 Best Workplace in Poland for a second year in a row and a top choice for Millennials by Great Place to Work®!\nAs a signatory to the Diversity Charter, Aviva applies a policy of equal treatment and creates a work environment that is friendly to people with disabilities. We do not require from candidates the date of birth, marital status and attached photos to your CV. We encourage all individuals regardless of gender to apply.\nMost of our people are smart working - spending also time in our office - combining the benefits of flexibility, with time together with colleagues.\nWe’re inclusive - we welcome applications from people with diverse backgrounds and experiences.\nExcited but not sure you tick every box? Research tells us that women, particularly, feel this way. So, regardless of gender, why not apply and try!\nTo find out more about current job offers at Aviva take a look here.","description_format":"text","description_chars":8244,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Polish","level":"Advanced (C1)","optional":false},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Cafeteria","Hybrid work","Parental leave"],"hiring_locations":[{"name":"Poland","iso":"PL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Property & Casualty Insurance","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-16T15:38:00Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":8,"expected_fill_days":37,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/aviva-canada-cyber-response-technical-team-lead","json_url":"https://alion.io/job/aviva-canada-cyber-response-technical-team-lead.json","meta":{"generated_at":"2026-10-26T02:42:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3557,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1074183},"rest":"https://alion.io/mcp/rest/get_company?id=1074183"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faviva-canada-cyber-response-technical-team-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faviva-canada-cyber-response-technical-team-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faviva-canada-cyber-response-technical-team-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aviva-canada-cyber-response-technical-team-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faviva-canada-cyber-response-technical-team-lead"}]}