Lead Incident Response Analyst – AI-Driven Security

EY; Poznań; On-site; PLN 240,000 - 320,000; Full time

Benefits offered by this job

EY Badges – global certification

Career Counselor

Private healthcare

Job summary

EY Poland is seeking an experienced Incident Response lead to investigate and respond to complex cybersecurity incidents across endpoints, networks and cloud environments. You will guide triage, containment, eradication, recovery and root cause analysis while mentoring junior analysts and developing playbooks.

You will work in EY.AI integrated teams, leveraging advanced security tools and collaborating across business units to strengthen incident response capabilities and deliver client value.

Qualifications

• Several years of professional experience in Incident Response, SOC operations, digital forensics or threat hunting.
• Broad knowledge of network, endpoint, OS, application, identity and data security.
• Advanced knowledge of incident investigation methodologies and the MITRE ATT&CK framework.
• Strong experience with SIEM, EDR/XDR, NDR, SOAR, detection and forensic tools.
• Strong knowledge of Windows, Linux, Active Directory, Entra ID and network protocols.

Responsibilities

• Independently lead technical response to high-severity cybersecurity incidents.
• Confirm attack scope, compromise level, vectors, and required actions.
• Perform advanced analysis of endpoint, network, identity, application and cloud telemetry.
• Reconstruct attack paths and prepare detailed incident timelines.
• Conduct threat hunting based on indicators and attacker behaviours.
• Design, oversee containment and eradication activities.
• Analyse malware, scripts, persistence, lateral movement and privilege escalation.
• Perform root cause analysis and define measures to prevent recurrence.
• Assess risks of restoring systems and services.
• Support decisions on network segmentation, resets, rebuilds and backups.
• Act as technical lead during major incidents.
• Mentor Junior Incident Response Analysts.
• Develop, test and improve incident response playbooks.
• Prepare technical sections of post-incident reports and reviews.

Skills

Incident Response

Threat Hunting

Digital Forensics

SOC Operations

Communication Skills

Tools

SIEM

EDR/XDR

NDR

SOAR

Windows

Linux

Active Directory

Entra ID

AWS/Azure/Google Cloud

Job description

EY Poland is seeking an experienced Incident Response lead to investigate and respond to complex cybersecurity incidents across endpoints, networks and cloud environments. You will guide triage, containment, eradication, recovery and root cause analysis while mentoring junior analysts and developing playbooks.

You will work in EY.AI integrated teams, leveraging advanced security tools and collaborating across business units to strengthen incident response capabilities and deliver client value.