Expert Cybersecurity Incident Response Analyst

Defend the digital frontier — lead the detection, response, and evolution of global cybersecurity operations!

Krakow-based opportunity with a hybrid work model, requiring six days per month from the office.

As an Expert Cybersecurity Incident Response Analyst, you will be working for our client, a global organization protecting its technology and information estate against evolving cyber threats. You will help detect, investigate, contain, mitigate, and remediate security incidents while strengthening monitoring, detection, threat hunting, and response capabilities across the organization.

Your main responsibilities:

• Respond to cybersecurity alerts across the global technology and information estate, identifying harmful behaviors and events.
• Lead incidents through containment, mitigation, remediation, and eradication, contributing detailed root cause analysis to post-incident reviews.
• Develop and implement new detection use cases and response playbooks across security platforms.
• Review and approve use cases and playbooks created by cybersecurity colleagues.
• Assess and continuously improve the effectiveness of analytical processes, playbooks, tooling, and workflows.
• Apply structured analytical methodologies to enhance threat intelligence and operational effectiveness.
• Provide expert-level technical guidance and leadership across threat hunting, monitoring, detection, analysis, and response.
• Mentor cybersecurity colleagues and collaborate with Cybersecurity and IT teams to improve capabilities and automate operational processes.

You're ideal for this role if you have:

• At least 5 years of experience in cybersecurity incident response, security operations, or a related field.
• Excellent investigative, analytical, problem-solving, troubleshooting, and decision-making skills.
• Experience defining and refining operational procedures, workflows, and processes for monitoring and detection.
• Strong knowledge of cybersecurity frameworks, including OWASP, ISO 2700x, CIST, and NIST.
• Good understanding of network protocols, including TCP, UDP, DNS, DHCP, IPSEC, and HTTP.
• Technical expertise in analyzing threat event data, evaluating malicious activity, and identifying attacker tactics.
• Demonstrated experience with SIEM tools, log management suites, Big Data, and cloud-based security solutions.
• Knowledge of cybersecurity technologies, operating systems, cloud platforms, and incident response or forensic tools.

It is a strong plus if you have:

• A developed external peer network for sharing cybersecurity intelligence.
• Experience with IDS/IPS/HIPS, advanced anti-malware, firewalls, proxies, or MSS technologies.
• Familiarity with AWS, Azure, and Google cloud platforms.
• Knowledge of tools such as EnCase, FTK, Sleuthkit, Kali Linux, or IDA Pro.

Language Required for the role: Fluent English.

Eligibility for the role: Only candidates with an existing legal right to work in Europe will be considered for this role.

#MAKEYourCareerBETTER

Interested? Apply now and include your CV (preferably in English) along with a statement confirming your consent to the processing and storage of your personal data.

Tech stack

• Cybersecurity incident response
• SIEM Tools
• Threat Hunting & Detection
• Network Protocols (TCP/UDP/DNS/HTTP)
• Security Frameworks (NIST/ISO 27001/OWASP)
• Playbook & Use Case Development
• Malware Analysis
• Cloud Security (AWS/Azure/GCP)
• Digital Forensics Tools (EnCase/FTK/Kali)
• IDS/IPS/Firewall Technologies