{"id":3168919,"url":"https://alion.io/job/ey-senior-incident-response-analyst","title":"Senior Incident Response Analyst","company":{"id":2859,"name":"EY","domain":"ey.com","url":"https://alion.io/company/ey-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Gdańsk, Poland"],"countries":["PL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":59000,"max_usd":107000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":29},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-23T18:04:39Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-26T11:31:42Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Join a cybersecurity team responsible for investigating and responding to complex security incidents across endpoint, network, identity, application and cloud environments. In this role, you will lead the technical response to high-severity incidents, from initial triage and containment through eradication, secure recovery and root cause analysis. You will also help strengthen the Incident Response capability by developing playbooks, sharing expertise and mentoring junior team members.\nEY.AI - in this role, you will work in an environment where AI agents are part of the team and everyday project work. You will use solutions tailored to specific areas that support data analysis, recommendation development and solution design. This will help you move more quickly from analysis to action and create value for clients.\nYour scope of duties\nIndependently leading the technical response to high-severity and critical cybersecurity incidents.\nConfirming the scope of an attack, level of compromise, attack vector, business impact and required response actions.\nPerforming advanced analysis of endpoint, network, identity, application and cloud telemetry.\nReconstructing attack paths and preparing detailed incident timelines.\nConducting threat hunting based on indicators of compromise, attacker behaviours, tactics, techniques and procedures.\nDesigning, recommending and overseeing containment and eradication activities.\nAnalysing malware, scripts, processes, persistence mechanisms, lateral movement and privilege escalation.\nPerforming root cause analysis and defining measures to prevent incident recurrence.\nAssessing the risks associated with restoring systems and services.\nSupporting decisions related to network segmentation, account and credential resets, system rebuilds, backup restoration and service recovery.\nActing as the technical lead during major cybersecurity incidents.\nMentoring Junior Incident Response Analysts.\nDeveloping, testing and improving incident response playbooks.\nPreparing the technical sections of post-incident reports and participating in post-incident reviews.\nOur requirements\nSeveral years of professional experience in Incident Response, Security Operations Centre operations, Digital Forensics and Incident Response, threat hunting or cyber defence.\nBroad knowledge of network, endpoint, operating system, application, identity and data security.\nAdvanced knowledge of incident investigation methodologies and the MITRE ATT&CK framework.\nStrong experience with SIEM, EDR/XDR, NDR, SOAR, detection and forensic tools.\nStrong knowledge of Windows, Linux, Active Directory, Microsoft Entra ID and network protocols.\nExperience in investigating phishing, ransomware, account compromise, application attacks and data exfiltration.\nHands-on experience with at least one major cloud platform, such as AWS, Microsoft Azure or Google Cloud.\nExperience in digital forensics, memory analysis, timeline analysis and evidence preservation.\nExperience in recovery activities, including secure service restoration, system rebuilds, backup validation and post-recovery monitoring.\nStrong communication skills and the ability to work effectively under pressure.\nWhat we offer\nParticipation in projects addressing complex cybersecurity incidents across diverse technology environments.\nAccess to advanced security technologies and opportunities to further develop expertise in Incident Response, threat hunting and digital forensics.\nA role with a real impact on the development of incident response playbooks, investigation standards and the broader Incident Response capability.\nProfessional and financial support in obtaining recognised qualifications and certificates.\nEY Badges - global certification of your competencies and the opportunity to earn an MBA title from the prestigious Hult International School of Business.\nCareer Counselor - professional, one-to-one guidance on career building and development.\nPsycho-educational platform - a package of free consultations with specialists in the broad field of mental health and personal development and access to educational activities.\nBenefit programme offering private healthcare with additional preventive examinations, life insurance, tickets, team sports, a language learning platform, sports cards and much more, available online and offline.\nRecruitment stages\nApply. If this is your first time applying, create a profile and upload your CV.\nLet’s talk. You will meet our Talent Acquisition experts and members of your future team.\nAbout EY Poland\nWe are a global consulting and technology company.\nWe make a difference by transforming and changing services, products, organisations and even the rules of the game. We combine business and technology, using artificial intelligence and real talent. We help organisations solve complex problems, make better decisions and implement changes for the better.\nWe provide confidence in data, opinions, standards, technology and security.\nEvery day, we take on challenges, analyse opportunities, create prompts, conduct research, collaborate, ask the right questions, plan, model, code, try new things and draw conclusions. We create solutions that are crucial for our clients.\nThis is where friendships, relationships and lifelong memories are made.\nThis is where you do difficult and important things with supportive and exceptional people.\nWe employ more than 390,000 exceptional people in over 150 countries worldwide. In Poland, over 7,000 of us work in Warsaw, Gdańsk, Katowice, Kraków, Łódź, Poznań, Rzeszów and Wrocław, as well as at the Global Delivery Services centres in Warsaw and Wrocław.\nWe care about the environment, not only the business environment. As part of our established plan, we have reduced global greenhouse gas emissions by 40% compared with the 2019 baseline.\nEY is an equal opportunities employer. We value and promote the diversity of knowledge, experience and perspectives within our community. We create an environment based on respect, openness and collaboration, where everyone can develop and make a real impact. We run the “Poziom Wyżej bez Barier” programme, which supports employees with disabilities in pursuing their ambitions and professional development goals.\nEY provides equal opportunities to all candidates throughout the recruitment process, regardless of sex, age, race, religion, sexual orientation, origin, disability or any other legally protected characteristic, in accordance with applicable law.","description_format":"text","description_chars":6489,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"master","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Financial Advisory, Valuation & Restructuring","Management Consulting","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-10-23T18:04:39Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":26,"reasons":["conf:4","velocity","win:early","comp:brand"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/ey-senior-incident-response-analyst","json_url":"https://alion.io/job/ey-senior-incident-response-analyst.json","meta":{"generated_at":"2026-10-26T13:25:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18618,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2859},"rest":"https://alion.io/mcp/rest/get_company?id=2859"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fey-senior-incident-response-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fey-senior-incident-response-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fey-senior-incident-response-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ey-senior-incident-response-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fey-senior-incident-response-analyst"}]}