Incident Response Analyst — Hands-on Cyber Defense

EY; Województwo pomorskie; Sur place; PLN 150 000 - 210 000; Plein temps

Avantages offerts par ce poste

Professional development

Employee benefits

On-site facilities

Résumé du poste

EY Poland is seeking an Incident Response Analyst to join a cyber security operations team. You will analyze alerts from SIEM/EDR/XDR, perform triage to identify incidents, assess impact and scope, and help contain and eradicate threats across Windows, Linux and cloud environments.

You will build incident timelines, document findings, and contribute to playbooks and knowledge bases while participating in on-call rotations and exercises.

Qualifications

• Basic knowledge of digital forensics and evidence preservation.
• Familiarity with SIEM, EDR/XDR, firewalls, proxies, IAM platforms and log analysis tools.
• Understanding of MITRE ATT&CK and incident response lifecycle.

Responsabilités

• Analyse alerts from SIEM, EDR/XDR, email security, IAM, firewall and cloud tools.
• Triage alerts and determine if an event is a security incident.
• Assess incident severity, scope and affected assets.
• Collect and analyse logs, endpoint artefacts, IPs, domains, file hashes.
• Identify indicators of compromise and suspicious activity.
• Contain incidents by isolating hosts, blocking IOCS and resetting passwords.
• Support eradication and recovery and verify threat removal.
• Build incident timelines and maintain complete case documentation.
• Participate in on-call rotations and exercises.

Connaissances

SIEM/EDR/XDR familiarity

Threat hunting basics

Scripting: PowerShell/Bash/Python

Cloud security basics

MITRE ATT&CK knowledge

Incident response lifecycle

Outils

PowerShell

Bash

Python

EDR/XDR

SIEM

Firewalls

IAM platforms

Description du poste

EY Poland is seeking an Incident Response Analyst to join a cyber security operations team. You will analyze alerts from SIEM/EDR/XDR, perform triage to identify incidents, assess impact and scope, and help contain and eradicate threats across Windows, Linux and cloud environments.

You will build incident timelines, document findings, and contribute to playbooks and knowledge bases while participating in on-call rotations and exercises.