Cyber Response Technical Team Lead

Aviva plc; Warszawa, Polska; Hybrid; PLN 260,000 - 480,000; Full time

Benefits offered by this job

Performance Bonus

Private medical care

Cafeteria benefits (MultiSport card)

Employee Shares Plan

Hybrid working model

Office in Warsaw

Job summary

Aviva Services Excellence Centre in Warsaw is seeking a Cyber Response Technical Team Lead to manage and grow a team of Senior Cyber Security Analysts within our Global Security Operations Centre (GSOC). The role blends hands-on incident response with people leadership and strategic capability building.

You will guide complex investigations, champion playbooks and automation, and collaborate with cross-functional security teams to strengthen detection, containment and recovery across endpoints,

Qualifications

• 6+ years in Cyber Security with hands-on SOC/IR/DFIR.
• Minimum 2 years people management in a SOC/CSIRT.
• Experience leading complex, high-severity incidents.
• Strong technical expertise across endpoints, networks, cloud and identity.
• Fluent Polish and English; international experience preferred.

Responsibilities

• Lead and manage a team of Senior Cyber Security Analysts/Incident Responders.
• Own team performance, engagement, development plans, and career progression.
• Provide coaching, mentoring, and technical leadership to enhance team capabilities.
• Coordinate day-to-day activities, workload prioritization, and scheduling.
• Manage capacity planning, on‑call rotations, and operational readiness.
• Act as primary GSOC escalation point for complex incidents and investigations.
• Lead containment, eradication and recovery activities during incidents.
• Provide expertise across endpoint, network, cloud, identity, and threat investigations.

Skills

Cyber leadership

Incident response

People management

SOC operations

MITRE ATT&CK

Communication

Threat detection

Tools

SIEM/XDR

PowerShell

Python

KQL

Job description

Hi, we’re glad you’re here! We are hiring to our Aviva Services Excellence Centre! Take a look at our job description - maybe it suits you or one of your friends? Aviva is looking for a Cyber Response Technical Team Lead to manage and develop a team of experienced Senior Cyber Security Analysts within our Global Security Operations Centre (GSOC). This role is a combination of hands‑on technical work and people leadership responsibility.

You’ll develop an existing and high‑performing team while remaining close to the action by responding to high severity and complex incidents together with your team. You’ll work across Aviva’s cyber organisation to strengthen our response capabilities, improve how we respond to threats, and drive continuous improvement across processes, playbooks, automation, AI and technology.

Aviva is for everyone! We’ve been ranked the #1 Best Workplace in Poland for a second year in a row and a top choice for Millennials by Great Place to Work. As a signatory to the Diversity Charter, Aviva applies a policy of equal treatment and creates a work environment that is friendly to people with disabilities. We do not require from candidates the date of birth, marital status and attached photos to your CV. We encourage all individuals regardless of gender to apply.

Why join us?

• Ready to take the next step in your cyber security leadership career? Join our Global Security Operations Centre (GSOC) and take responsibility for a team of experienced Senior Security Analysts protecting our organisation against evolving cyber threats.
• Lead People, Stay Close to Cyber: Develop and grow an experienced team while remaining engaged in hands‑on cyber incident response activities.
• In‑House Power: We run our security internally, giving you the opportunity to directly influence our people, operations and cyber defence capabilities.
• Constant Evolution: Drive improvements across incident response processes, automation and emerging technologies while staying close to the changing threat landscape.
• Cyber – A Core Aviva Priority: Cyber security is deeply embedded across the business, with continued investment in our people and capabilities.
• Make an Impact: Help shape how our GSOC function evolves and how we protect Aviva from cyber threats.

What will you be doing?

• Leading and managing a team of Senior Cyber Security Analysts/Incident Responders
• Owning team performance, engagement, development plans, and career progression
• Providing coaching, mentoring, and technical leadership to enhance team capabilities and expertise
• Coordinating day‑to‑day activities, workload prioritization, resource allocation, and team scheduling
• Managing team capacity planning, on‑call rotations, shift coverage, and operational readiness
• Acting as the primary GSOC escalation point for complex and high‑severity cyber security incidents
• Leading and supporting hands‑on investigations, containment, eradication, and recovery activities during cyber incidents
• Providing advanced technical guidance across endpoint, network, cloud, identity, and threat investigations
• Ensuring high‑quality incident response practices, investigation standards, and operational excellence
• Coordinating incident response activities with internal stakeholders, customers, and other Cyber Security teams
• Driving post‑incident reviews from the GSOC perspective and ensuring lessons learned are translated into measurable improvements
• Identifying skill gaps and developing training, knowledge‑sharing, and capability‑building initiatives
• Supporting recruitment, onboarding, succession planning, and retention of cyber security talent within GSOC
• Acting as a Subject Matter Expert (SME) in Cyber Security projects, strategic initiatives, and customer engagements
• Providing expert input into the design, implementation, and enhancement of cyber security services and capabilities
• Driving continuous improvement of incident response processes, fine‑tuning of detection rules, playbooks, tooling, and operational procedures
• Championing automation initiatives to improve GSOC efficiency, investigation quality, and response times
• Driving adoption and effective use of AI and emerging technologies across GSOC and other relevant areas where required
• Collaborating with Detection Engineering, Cyber Incident Management, Threat Hunting, Threat Intelligence, Security Engineering, and Product teams to enhance cyber defence capabilities
• Staying current with emerging threats, attacker techniques, and industry best practices to strengthen response capabilities
• Contributing to the strategic development and maturity of the organization's Cyber Response and Security Operations functions

What we’re looking for?

• 6+ years of experience in Cyber Security, including significant hands‑on experience in Security Operations, Incident Response, or DFIR.
• Minimum 2 years of proven people management experience, with direct responsibility for team performance, development, engagement, and career progression.
• Demonstrated experience managing and developing senior Cyber Security professionals, ideally within a SOC, CSIRT, Cyber Response or Incident Response function.
• Proven experience in performance management, coaching, mentoring, development planning, and career progression.
• Experience managing team capacity, workload prioritisation, resource allocation, on‑call rotations, and operational readiness.
• Extensive hands‑on experience leading the response to complex and high‑severity cyber security incidents, including investigation, containment, eradication and recovery.
• Proven ability to act as a senior technical escalation point during major cyber security incidents and provide leadership under pressure.
• Strong technical expertise across multiple security domains, including endpoint, network, identity, cloud, SIEM/XDR, threat hunting and digital forensics.
• Strong understanding of MITRE ATT&CK, attacker TTPs and modern investigation methodologies.
• Experience developing and improving incident response playbooks, investigation standards, detection capabilities and operational procedures.
• Experience driving continuous improvement and automation within Security Operations, including the effective use of SOAR, AI and emerging technologies.
• Strong stakeholder management skills and experience working across multiple Cyber Security and Technology functions.
• Ability to communicate complex cyber security matters effectively to both technical and senior business stakeholders.
• Fluent Polish and English, both spoken and written.
• Experience working in an international environment.

Nice to have:

• Industry certifications such as GCIH, GCFA, GCFE, CISSP, OSCP or SC-200.
• Experience with KQL, PowerShell or Python and security automation.

In Aviva Services Excellence Centre, we provide:

• Contract of employment
• Performance Bonus
• Private medical care (ENEL-MED)
• Cafeteria system of benefits (e.g. MultiSport card)
• Additional parent privileges:
• baby leave – 6 weeks leave for second parent
• shortened working time after parental leave
• Employer-funded group insurance
• Employee Shares Plan
• Extra day off for birthday
• Paid time off to volunteer
• Additional leave acquired over the years in the company (even 5 days more in a year)
• Wellbeing Leave – additional two weeks paid leave after 10 years of service
• Psychological support consultations
• Access to the e-learning platforms
• Internal employee referral program
• Hybrid working model from Poland with a few days in Warsaw office per month
• Attractive office location in Warsaw - Gdański Business Center
• Additional entitlements for people with disabilities - Work Without Barriers
• Work environment that promotes diversity - Diversity Charter

Most of our people are smart working – spending also time in our office – combining the benefits of flexibility, with time together with colleagues.

We’re inclusive – we welcome applications from people with diverse backgrounds and experiences.

To give these customers the best possible products and service we know we must make Aviva the most attractive choice for talented, entrepreneurial people with diverse backgrounds and an evolving range of expertise and insight. So, we’re passionate about helping our 23,000 people to do the best work of their lives, to enable them to make a positive difference to the lives of our customers.