InfoSec Lead: Incident Response & Cloud Security

PeopleFinders, LLC; Polska; Hybrid; PLN 591,000 - 650,000; Full time

Benefits offered by this job

Flexible PTO

401K match

Medical, dental and vision insurance (

Dependent coverage available

Job summary

PeopleFinders, LLC is seeking an Information Security Lead to own day-to-day security for applications, infrastructure and internal systems. You will detect threats, drive incident response, and work with engineering teams to implement durable controls, while communicating status to leadership.

This hands-on role requires attacker mindset, collaboration, and ability to translate risk into actionable remediation, with a strong focus on AWS, secure coding, and threat mitigation across the cloud

Qualifications

• 5+ years in information security, with hands-on experience across incident response, cloud security, application security, network security, or vulnerability management.
• Experience leading security incidents from detection through root cause and reporting.
• Hands-on experience securing AWS and internet-facing web applications and APIs; working knowledge of OWASP risks.
• Experience with firewalls and VPN/remote-access security, and with endpoint protection (EDR/AV) and device management.
• Experience with WAF, bot management, DDoS protection, and CDN security.
• Strong log analysis skills across firewall, application, cloud, and identity sources.
• Working knowledge of IAM, MFA, encryption, and secrets management.
• Experience supporting SOC 2, PCI DSS, or similar compliance programs.
• Scripting and API skills (Python, PowerShell, or similar) for investigation and automation.
• Ability to prioritize by business impact and likelihood, and to explain that reasoning.

Responsibilities

• Lead investigations of security alerts and incidents end to end: scoping, evidence collection and preservation, containment, root-cause analysis, and corrective actions.
• Coordinate with the managed detection and response provider, triage escalations, and track findings to closure.
• Write clear status updates and post-incident reports for leadership, engineering, and external parties where needed.
• Maintain incident response procedures, runbooks, and evidence-handling practices.
• Assess newly disclosed vulnerabilities and supply-chain events against our environment within hours.
• Run vulnerability scanning and external scanning programs, coordinate penetration tests, and track remediation.
• Track vendor fixes and verify remediation once deployed.
• Protect web applications and APIs; review architecture, authentication flows, and code changes for security risk.
• Lead bot mitigation, scraping prevention, fraud signals, rate limiting, and traffic analysis using Cloudflare, DataDome, or similar platforms.
• Partner with developers on secure coding, OWASP risks, and remediation, and integrate security checks into CI/CD (SAST, dependency, and container scanning).
• Secure AWS environments, including identity, logging, threat detection, and configuration baselines, and containerized workloads.
• Help secure data platforms such as Snowflake, SQL Server, MongoDB, and data pipelines, with emphasis on access control and sensitive-data protection.
• Manage firewall, VPN, and remote-access security, including MFA, session policy, lockout standards, and threat-prevention content.
• Enforce device and endpoint standards (managed devices, EDR and antivirus coverage, patching) and close coverage gaps.
• Drive least-privilege access, MFA, secrets management, privileged-access controls, and periodic access reviews across directory, cloud, and SaaS platforms.
• Maintain security policies and the policy-exception process, and apply policy to real decisions such as remote access, offboarding and equipment, and personal devices.
• Support SOC 2, PCI DSS, and privacy obligations with evidence, audit responses, and control improvements.
• Conduct vendor security reviews, and evaluate and help select security tools and services.
• Translate security risk into plain-language options and trade-offs for executives and engineering leaders, leaving decisions with the owners.
• Document decisions and changes in the ticketing system and keep a durable record of outcomes.
• Promote security awareness and build safe automation and AI-assisted tooling that extends the team’s reach.

Skills

Incident response

Cloud security

Application security

Network security

Vulnerability management

Tools

AWS

WAF

Cloudflare

DataDome

SIEM

EKS/ECR

Job description

PeopleFinders, LLC is seeking an Information Security Lead to own day-to-day security for applications, infrastructure and internal systems. You will detect threats, drive incident response, and work with engineering teams to implement durable controls, while communicating status to leadership.

This hands-on role requires attacker mindset, collaboration, and ability to translate risk into actionable remediation, with a strong focus on AWS, secure coding, and threat mitigation across the cloud