L2 Security Analyst

HCL Technologies Limited; Kraków; On-site; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Life insurance

Private medical care

MultiSport Card

Subsidy for glasses

Subsidy for language courses

Christmas and holiday bonuses

Clear career path

Job summary

HCLTech in Kraków seeks an L2 Security Analyst to monitor and respond to identity-based and endpoint threats using Defender for Endpoint. The role requires 24x7 coverage and collaboration with global security teams for threat detection, containment, and remediation.

You will analyze SIEM data, tune detection rules, and provide actionable feedback to improve security content. Excellent communication and client-facing skills are essential in a fast-paced environment.

Qualifications

• Skilled in managing extensive and intricate networks.
• Hands‑on experience with continuous SIEM monitoring, validating alerts, and investigating across identity, endpoint, and network security data.

Responsibilities

• Real-time monitoring, investigation, and response to threats.
• Collaborate with global security teams to ensure threat detection, containment, and remediation.
• Refine SIEM use cases and detection logic based on feedback and evolving threats.
• Provide actionable feedback to content management and detection engineering teams to optimize rules.
• Produce monthly, weekly, and daily security reports.

Skills

SIEM monitoring

Threat hunting

EDR platforms

MITRE framework

Incident response

Log analysis

Tools

Microsoft Defender for Endpoint

Job description

We are HCLTech, one of the fastest-growing large tech companies in the world and home to 219,000+ people across 54 countries, supercharging progress through industry-leading capabilities centered around Digital, Engineering and Cloud.

The driving force behind that work, our people, are diverse, creative, and passionate, raising the bar for excellence on a regular basis. We, in turn, work hard to bring out the best in them as we strive to help them find their spark and become the best version of themselves that they can be.

If all this sounds like an environment you’ll thrive in, then you’re in the right place. Join us on our journey to advancing the technological world through innovation and creativity.

______________________________________________________________

The L2 Security Analyst will be responsible for real-time monitoring, investigation, and response to identity-based and endpoint security threats using Microsoft Defender for Endpoint (MDE). This role requires 24x7 support coverage and collaboration with global security teams to ensure threat detection, containment, and remediation in a fast-paced environment.

Qualifications

• Skilled in managing extensive and intricate networks.
• Brings substantial hands‑on experience with continuous SIEM monitoring, validating alerts, and investigating across identity, endpoint, and network security data, demonstrating expertise in correlating events from multiple sources to detect real threats.
• Possesses strong analytical skills to refine SIEM use cases and detection logic based on monitoring feedback, false positive reviews, and evolving threat landscapes, ensuring an enhanced signal‑to‑noise ratio and greater operational effectiveness.
• Proficient at evaluating SIEM alerts and incident patterns, identifying detection coverage gaps, and delivering clear, actionable feedback to content management and detection engineering teams for optimizing and enhancing rules.
• Self‑driven and innovative, takes initiative and ownership of responsibilities, collaborates effectively with team members, and consistently delivers organized, high‑quality results.
• The ideal candidate is eager to comprehend complex issues and requirements, excels at turning them into practical solutions, and pays careful attention to details.
• Has knowledge or experience with various SIEM tools, Intrusion Detection Systems (IDS), and roles in network security.
• Familiar with the MITRE framework or similar standards; possesses hands‑on expertise with EDR platforms, threat analysis, and has engaged in threat hunting or incident response.
• Understands network, system, and endpoint security disciplines.
• Experienced in event monitoring, analysis, escalation procedures, and providing feedback for content improvement.
• Adept at producing monthly, weekly, and daily reports.
• Open to working in a 24/7 operational environment.
• Reviews escalated SIEM incidents to verify true positive cases.
• Delivers monthly trend analyses and security summary reports.
• Supports SIEM event and incident analytics.
• Provides log analysis summaries and offers recommendations for incident detection and prevention.
• Conducts advanced triage and works collaboratively with resolution teams, third parties, or designated customer contacts.
• Coordinates with cross‑functional teams to help develop security incident response reports.
• Promotes the implementation of protection and mitigation strategies derived from lessons learned.
• Shall have good verbal/written communication skills
• Should be willing to work in 24x7 environments
• From time‑to‑time travel opportunities may be assigned
• Incumbent should carry continual system improvement mindset and able to demonstrate in work.
• Client facing technical analysis report and presentation skills

Why Us?

• We are one of the fastest-growing large tech companies in the world, with offices in 50+ countries across the globe and 219,000 employees
• Our company is extremely diverse with 165 nationalities represented
• We offer the opportunity to work with colleagues across the globe
• We offer a virtual‑first work environment, promoting a good work‑life integration and real flexibility
• We are invested in your growth, offering learning and career development opportunities at every level to help you find your own unique spark
• Life insurance
• Private medical care
• MultiSport Card
• Subsidy for glasses
• Subsidy to language courses
• Christmas and holiday bonuses
• Clear career path in a growing multinational organization