Expert Cybersecurity Incident Response Analyst

ITDS; Kraków; Hybrid; PLN 180,000 - 280,000; Full time

Job summary

ITDS is seeking an Expert Cybersecurity Incident Response Analyst to join a Krakow-based team operating in a hybrid model. You will detect, investigate, contain, mitigate, and remediate security incidents while strengthening monitoring, detection, threat hunting, and response capabilities across the organization.

The role requires at least 5 years in cybersecurity incident response or related security operations, with strong analytical, problem-solving, and decision-making skills.

Qualifications

• At least 5 years of experience in cybersecurity incident response, security operations, or a related field.
• Excellent investigative, analytical, problem-solving, troubleshooting, and decision-making skills.
• Experience defining and refining operational procedures, workflows, and processes for monitoring and detection.
• Strong knowledge of cybersecurity frameworks, including OWASP, ISO 2700x, CIST, and NIST.
• Good understanding of network protocols, including TCP, UDP, DNS, DHCP, IPSEC, and HTTP.
• Technical expertise in analyzing threat event data, evaluating malicious activity, and identifying attacker tactics.
• Demonstrated experience with SIEM tools, log management suites, Big Data, and cloud-based security solutions.

Responsibilities

• Respond to cybersecurity alerts across the global technology and information estate, identifying harmful behaviors and events.
• Lead incidents through containment, mitigation, remediation, and eradication, contributing detailed root cause analysis to post-incident reviews.
• Develop and implement new detection use cases and response playbooks across security platforms.
• Review and approve use cases and playbooks created by cybersecurity colleagues.
• Assess and continuously improve the effectiveness of analytical processes, playbooks, tooling, and workflows.
• Apply structured analytical methodologies to enhance threat intelligence and operational effectiveness.
• Provide expert-level technical guidance and leadership across threat hunting, monitoring, detection, analysis, and response.
• Mentor cybersecurity colleagues and collaborate with Cybersecurity and IT teams to improve capabilities and automate operational processes.

Skills

Incident response

Threat hunting

Analytical thinking

Problem solving

Decision making

Tools

SIEM tools

Log management

Big Data

Cloud security solutions

Job description

Defend the digital frontier — lead the detection, response, and evolution of global cybersecurity operations!

Krakow-based opportunity with a hybrid work model, requiring six days per month from the office.

As an Expert Cybersecurity Incident Response Analyst, you will be working for our client, a global organization protecting its technology and information estate against evolving cyber threats.

You will help detect, investigate, contain, mitigate, and remediate security incidents while strengthening monitoring, detection, threat hunting, and response capabilities across the organization.

Your main responsibilities:

• Respond to cybersecurity alerts across the global technology and information estate, identifying harmful behaviors and events.
• Lead incidents through containment, mitigation, remediation, and eradication, contributing detailed root cause analysis to post-incident reviews.
• Develop and implement new detection use cases and response playbooks across security platforms.
• Review and approve use cases and playbooks created by cybersecurity colleagues.
• Assess and continuously improve the effectiveness of analytical processes, playbooks, tooling, and workflows.
• Apply structured analytical methodologies to enhance threat intelligence and operational effectiveness.
• Provide expert-level technical guidance and leadership across threat hunting, monitoring, detection, analysis, and response.
• Mentor cybersecurity colleagues and collaborate with Cybersecurity and IT teams to improve capabilities and automate operational processes.

You're ideal for this role if you have:

• At least 5 years of experience in cybersecurity incident response, security operations, or a related field.
• Excellent investigative, analytical, problem-solving, troubleshooting, and decision-making skills.
• Experience defining and refining operational procedures, workflows, and processes for monitoring and detection.
• Strong knowledge of cybersecurity frameworks, including OWASP, ISO 2700x, CIST, and NIST.
• Good understanding of network protocols, including TCP, UDP, DNS, DHCP, IPSEC, and HTTP.
• Technical expertise in analyzing threat event data, evaluating malicious activity, and identifying attacker tactics.
• Demonstrated experience with SIEM tools, log management suites, Big Data, and cloud-based security solutions.
• Knowledge of cybersecurity technologies, operating systems, cloud platforms, and incident response or forensic tools.

It is a strong plus if you have:

• A developed external peer network for sharing cybersecurity intelligence.
• Experience with IDS/IPS/HIPS, advanced anti-malware, firewalls, proxies, or MSS technologies.
• Familiarity with AWS, Azure, and Google cloud platforms.
• Knowledge of tools such as EnCase, FTK, Sleuthkit, Kali Linux, or IDA Pro.

Language Required for the role:

Fluent English.

Eligibility for the role:

Only candidates with an existing legal right to work in Europe will be considered for this role.

#MAKEYourCareerBETTER