Global SOC Security Analyst — Real-Time Incident Owner

Aviva plc; Województwo mazowieckie; Hybrid; PLN 120,000 - 180,000; Full time

Benefits offered by this job

Private medical care

Cafeteria benefits

Hybrid work

Employee Shares Plan

Wellbeing Leave

Diversity Charter

Job summary

Aviva plc is seeking a Security Analyst to monitor and respond to cyber threats across the group. You will manage incidents end-to-end, drive containment and recovery, and contribute to threat detection improvements in a global GSOC environment.

The role requires 1+ year SOC experience and strong English skills, with familiarity in NIST, ITIL, MITRE ATT&CK and the Cyber Kill Chain. Hybrid work is offered from Poland with office days in Warsaw.

Qualifications

• At least 1 year of hands-on experience as a SOC Analyst.
• English level at minimum B2/C1 (written and spoken).
• Solid understanding of NIST incident management, ITIL Foundation, MITRE ATT&CK and the Cyber Kill Chain.

Responsibilities

• Real-Time Defence: Monitoring IT security breaches and responding to incidents to mitigate threats.
• Incident Ownership: Driving incident response through detection, containment, eradication and recovery.
• Threat Correlation: Connecting dots between threats to form the bigger picture.
• Detection Optimization: Recommending improvements for correlation rules and radar tuning.
• Documentation Mastery: Drafting GSOC playbooks, response plans and processes.
• Subject Matter Expertise: Acting as SME for GSOC and Detection & Response projects.

Skills

SOC analysis

Threat monitoring

Incident response

English proficiency

Tools

DLP

EDR

SIEM

Firewalls

IPS/IDS

SOAR

Job description

Aviva plc is seeking a Security Analyst to monitor and respond to cyber threats across the group. You will manage incidents end-to-end, drive containment and recovery, and contribute to threat detection improvements in a global GSOC environment.

The role requires 1+ year SOC experience and strong English skills, with familiarity in NIST, ITIL, MITRE ATT&CK and the Cyber Kill Chain. Hybrid work is offered from Poland with office days in Warsaw.