BlueSec Cybersecurity Engineer

Allegro Ltd.; Województwo wielkopolskie; Hybrid; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work model (4/1)

Annual bonus

Flexible working hours

30 days occasional remote work

Well-located offices • kitchens • bike

Job summary

Allegro Ltd. in Poland hosts a Large-Scale Hybrid Security Engineering role focused on securing Azure, GCP, and on-prem environments. You will drive vulnerability management, cloud security posture, and automation for rapid response, with collaboration across enterprise teams.

The team emphasizes end-to-end ownership, measurable improvements, and the adoption of AI tools to accelerate security operations. Enjoy flexible hours, hybrid work, and a generous bonus program in a vibrant tech ecosystem.

Qualifications

• Demonstrate high independence and a self-driven approach – you can take end-to-end ownership of security improvements, from assessment and design through implementation, measurement, and operational handover.
• Hands-on experience securing cloud environments, preferably Azure and/or GCP, including Kubernetes and container workloads, cloud posture management, configuration hardening, and remediation of security findings.
• Understand vulnerability management and patching processes, including asset inventory, risk prioritization, exception handling, and collaboration with asset owners.
• Know security standards and control frameworks such as CIS Benchmarks and NIST CSF, and can translate them into practical technical baselines.
• Have practical knowledge of IAM and identity security, including privileged access, MFA, and Entra Conditional Access; experience managing security configuration as code (Terraform) is a plus.
• Familiar with network-security concepts and technologies such as firewalls, network segmentation, secure web gateways, SASE, DNS, TLS, and proxy routing.
• Experience with security automation, workflow orchestration, enrichment, ticketing integrations, or response playbooks.
• Understand external attack-surface and exposure management, including discovery and monitoring of domains, public IPs, cloud assets, and misconfigurations.
• Can create clear technical documentation, runbooks, and remediation guidance, and collaborate effectively with engineering, network, IAM, and service-owner teams.
• Want to be proud of the impact they make; value high-quality security reviews and engage in substantive discussions on software engineering and security best practices.
• Open to developing soft skills and embracing a growth mindset through retrospectives and cross-team collaborations.
• Are excited about adopting and securing AI technologies, to maximize efficiency.
• Look for effective, business-enabling solutions to security requirements set by our ecosystem.
• Maintain knowledge in a rapidly shifting threat landscape.
• Know English at least B2 level.

Responsibilities

• Take end-to-end ownership of security improvements, from identifying risks and designing controls through implementation, measurement, and operational handover.
• Build and maintain security controls across Azure, GCP, and on-premises environments, focusing on cloud posture, identity, hardening, and configuration security.
• Improve vulnerability-management and patching processes by increasing asset coverage, defining remediation priorities, managing exceptions, and collaborating with system and service owners.
• Implement and maintain security baselines based on CIS Benchmarks and NIST principles, including measurable compliance checks and clear remediation paths.
• Strengthen identity and access controls, including privileged access, MFA, Entra Conditional Access, and policy-as-code practices.
• Help deliver and operate network and endpoint-security capabilities, including SASE, secure web gateways, firewall rules, network segmentation, and related telemetry.
• Develop external attack-surface monitoring for domains, public IPs, certificates, cloud assets, and exposed services; ensure findings are assigned, prioritized, and tracked to remediation.
• Maintain clear technical documentation, service runbooks, alerting, and on-call procedures so that security services are reliable and supportable.
• Partner with engineering, network, IAM, and service-owner teams to deliver pragmatic, business-enabling security solutions.

Skills

Cloud security

Azure

GCP

Kubernetes

Terraform

Vulnerability management

Security automation

Identity and access management

Network security

English (B2+)

Tools

SASE

NIST/ CIS Benchmarks

Job description

Flexible working hours in the hybrid model (4/1) - working hours start between 7:00 a.m. and 9:00 a.m. We also have 30 days of occasional remote work.

Annual bonus based on your annual performance and company results.

Our team is based in Warsaw and Poznań.

About the job

Secure a Large-Scale Hybrid Environment: Build, operate, and improve security controls across Azure, GCP, and on-premises environments supporting one of the region's largest marketplaces.

Engineer Measurable Protection: Work on vulnerability management, patching coverage, cloud security posture management, asset ownership, and compliance controls that make security risks visible, prioritized, and actionable.

Modernize Network and Endpoint Security: Help deliver SASE and web-security capabilities, strengthen firewalling and network segmentation, and improve telemetry and protection for workstations and services.

Reduce External Exposure Through Automation: Develop monitoring for public domains, IPs, certificates, and services; use automated playbooks to enrich findings, identify owners, create tickets, and support response actions.

Improve Detection and Resilience: Partner with engineering, network, IAM, and service-owner teams to harden identity and cloud configurations, turn security improvements into maintainable services with clear runbooks.

Skills required

Demonstrate high independence and a self-driven approach - you can take end-to-end ownership of security improvements, from assessment and design through implementation, measurement, and operational handover;

Have hands-on experience securing cloud environments, preferably Azure and/or GCP, including Kubernetes and container workloads, cloud security posture management, configuration hardening, and remediation of security findings;

Understand vulnerability management and patching processes, including asset inventory, risk prioritization, exception handling, and collaboration with asset owners;

Know security standards and control frameworks such as CIS Benchmarks and NIST CSF, and can translate them into practical technical baselines;

Have practical knowledge of IAM and identity security, including privileged access, MFA, and Entra Conditional Access; experience managing security configuration as code, e.g. with Terraform, is a plus;

Are familiar with network-security concepts and technologies such as firewalls, network segmentation, secure web gateways, SASE, DNS, TLS, and proxy routing;

Have experience with security automation, such as workflow orchestration, enrichment, ticketing integrations, or response playbooks;

Understand external attack-surface and exposure management, including discovery and monitoring of domains, public IPs, cloud assets, and misconfigurations;

Can create clear technical documentation, runbooks, and remediation guidance, and collaborate effectively with engineering, network, IAM, and service-owner teams;

Want to be proud of the impact they make; they value high-quality security reviews and engage in substantive discussions on software engineering and security best practices;

Are open to developing soft skills and embracing a growth mindset through active participation in team retrospectives and cross-team collaborations;

Are excited about adopting and securing AI technologies, being ready to incorporate AI coding and security assistants into their daily work to maximize efficiency;

Can look for effective, business-enabling solutions to the security requirements set by our ecosystem;

Want to constantly develop and update their knowledge in a rapidly shifting threat landscape;

Know English at least B2 level.

What's in it for you:

Well-located offices (with e.g. fully equipped kitchens, bicycle parking, terraces full of greenery) and excellent work tools (e.g., raised desks, ergonomic chairs, interactive conference rooms).

A 16" or 14" MacBook Pro or corresponding Dell with Windows (if you don't like Macs) and all the necessary accessories.

A wide selection of fringe benefits in a cafeteria plan - you choose what you like (e.g., medical, sports or lunch packages, insurance, purchase vouchers).

English classes that we pay for related to the specific nature of your job.

A training budget, inter-team tourism, hackathons, and an internal learning platform where you will find multiple trainings.

An additional day off for volunteering, which you can use alone, with a team, or with a larger group of people connected by a common goal.

Social events for Allegro people - Spin Kilometers, Family Day, Fat Thursday, Advent of Code, and many other occasions we enjoy.

And that's just the beginning! You can read more about the benefits here .

#goodtobehere means that:

You will join a team you can count on - we work with top-class specialists who have knowledge- and experience-sharing in their DNA.

You will love our level of autonomy in team organization, the space for continuous development, and the opportunity to try new things. You get to choose which technology solves the problem and you are responsible for what you create.

You will be equipped with modern AI tools to automate repetitive tasks, allowing you to focus on analyzing complex threats, developing advanced security automation, and refining secure architectures.

You will meet the Allegro Scale, which starts with over 1000 microservices, an open-source data bus (Hermes) with 300K+ rps, a Service Mesh with 1M+ rps, tens of petabytes of data, and production-used machine learning.

You will become part of Allegro Tech - We speak at industry conferences, cooperate with tech communities, run our own blog (it's been over 10 years!), record podcasts, lead guilds, and we organize our own internal conference - the Allegro Tech Meeting. We create solutions we love (and can) to talk about!

Your main responsibilities:

Take end-to-end ownership of security improvements, from identifying risks and designing controls through implementation, measurement, and operational handover.

Build and maintain security controls across Azure, GCP, and on-premises environments, with a focus on cloud posture, identity, hardening, and configuration security.

Improve vulnerability-management and patching processes by increasing asset coverage, defining remediation priorities, managing exceptions, and collaborating with system and service owners.

Implement and maintain security baselines based on CIS Benchmarks and NIST principles, including measurable compliance checks and clear remediation paths.

Strengthen identity and access controls, including privileged access, MFA, Entra Conditional Access, and policy-as-code practices.

Help deliver and operate network and endpoint-security capabilities, including SASE, secure web gateways, firewall rules, network segmentation, and related telemetry.

Develop external attack-surface monitoring for domains, public IPs, certificates, cloud assets, and exposed services; ensure findings are assigned, prioritized, and tracked to remediation.

Maintain clear technical documentation, service runbooks, alerting, and on-call procedures so that security services are reliable and supportable.

Partner with engineering, network, IAM, and service-owner teams to deliver pragmatic, business-enabling security solutions.

Don’t wait until you join us! Let's meet online!

Get to know our team, take a peek at our office life and check out what else we do at Allegro.