Cybersecurity Operations Director

Scovai; Województwo mazowieckie; Hybrid; PLN 300,000 - 540,000; Full time

Job summary

Scovai is seeking a Cybersecurity Operations Director to lead a regional SOC in Warsaw with hybrid work. The role oversees detection and response at scale across the organization''s global infrastructure.

You will build and mature SIEM/SOAR platforms, drive threat hunting, incident response, and automate processes to reduce detection and response times.

Qualifications

• Experience leading 24/7 SOC operations.
• Proven track record in threat detection, alert triage, and incident response.
• Certifications such as GCIH/GCFA/CISSP or equivalent preferred.

Responsibilities

• Own round-the-clock SOC operations across the organization''s global infrastructure.
• Lead build-out and maturity of SIEM/SOAR platforms and detection engineering capabilities.
• Direct threat hunting programmes, coordinate major incident response and post-incident forensics.

Skills

Leadership

Security Operations

Incident Response

Threat Hunting

Tools

SIEM/SOAR

Job description

We are conducting a confidential search for a Cybersecurity Operations Director to lead 24/7 security operations for an organisation building out a regional security operations centre in Warsaw, working hybrid. Warsaw's growing role as a European security and shared-services centre makes this a director-level opportunity for a leader who can own detection and response at scale.

In this role, you will own round-the-clock SOC operations covering threat detection, alert triage, and incident response across the organisation's global infrastructure, and lead the build-out and maturity of SIEM/SOAR platforms and detection engineering capabilities. You will direct threat hunting programmes, coordinate major incident response and post-incident forensics, and ensure SOC processes meet service-level commitments to internal stakeholders and, where applicable, external clients.

You will build and lead a multi-shift SOC team of analysts, threat hunters, and detection engineers, partner with security architecture and IT teams on control gaps identified through operations, and represent SOC performance and risk trends to security leadership and executive stakeholders. You will also drive automation of repetitive triage work to lift analyst capacity and reduce mean-time-to-detect and respond.

Nice to Have:

• Experience building or scaling a 24/7 SOC from the ground up
• Background with SIEM/SOAR platform selection and detection engineering
• Direct experience leading major incident response and forensics
• Relevant certifications (GCIH, GCFA, CISSP, or equivalent)
• Experience running a SOC serving multiple internal or external stakeholder groups
  
  

Nice to have

• Experience building or scaling a 24/7 SOC from the ground up
• Background with SIEM/SOAR platform selection and detection engineering
• Direct experience leading major incident response and forensics
• Relevant certifications (GCIH, GCFA, CISSP, or equivalent)
• Experience running a SOC serving multiple internal or external stakeholder groups