Security Investigator

Estarta Poland; Poland; On-site; PLN 180,000 - 320,000; Full time

Job summary

Estarta Poland is seeking an experienced Senior CSOC Analyst / Investigator to join our Cyber Security Operations Center. You will lead complex investigations, mentor analysts, and act as a trusted advisor to customers while delivering incident response and threat intelligence capabilities.

You will own security operations, drive improvements, collaborate with Threat Intelligence teams, and contribute to strategic CSOC initiatives across the organization.

Qualifications

• Bachelor's degree in Computer Science or equivalent required.
• Advanced degree strongly preferred.

Responsibilities

• Lead the triage, investigation, and resolution of complex cybersecurity incidents.
• Analyze security events and perform root cause analysis to recommend long-term actions.
• Manage customer escalations and provide timely, high-quality responses to complex queries.
• Maintain incident documentation and ensure effective communication with customers and internal teams.
• Collaborate with cross-functional teams to ensure effective incident response and business alignment.
• Collaborate with Threat Intelligence to identify threats, actors, and TTPs.
• Perform threat hunting based on emerging IOCs, vulnerabilities, and intelligence findings.
• Conduct malware analysis and reverse engineering.
• Develop actionable Threat Intelligence use cases, hunting scenarios, and supporting documentation.
• Define and leverage intelligence metrics to measure operational effectiveness.

Skills

Blue Team ops

Security monitoring

Incident investigation

Threat intelligence

Threat hunting

Malware analysis

Analytical thinking

Troubleshooting

Automation skills

Independent investigations

Education

Bachelor's degree

Advanced degree preferred

Job description

We are looking for an experienced Senior CSOC Analyst / Investigator to join our Cyber Security Operations Center (CSOC).

In this role, you will investigate and respond to cybersecurity incidents, analyze threats, and continuously improve the security solutions and services protecting our customers' environments.

As a senior member of the team, you will take ownership of complex investigations, act as a trusted technical advisor to customers, lead delivery projects, and drive improvements across security operations. You will also mentor other analysts, share expertise, and contribute to strategic initiatives across the global CSOC organization.

Your Responsibilities

Security Operations & Incident Investigation

• Lead the triage, investigation, and resolution of complex cybersecurity incidents.
• Analyze security events, perform root cause analysis, and recommend long-term corrective actions.
• Manage customer escalations and provide timely, high-quality responses to complex technical queries.
• Maintain accurate incident documentation and ensure effective communication with customers and internal teams.
• Collaborate with cross-functional teams to ensure effective incident response and alignment with customer business objectives.
• Collaborate with Threat Intelligence teams to identify and analyze relevant threats, threat actors, and TTPs.
• Perform threat hunting based on emerging IOCs, vulnerabilities, and intelligence findings.
• Conduct malware analysis and reverse engineering.
• Develop actionable Threat Intelligence use cases, hunting scenarios, and supporting documentation.
• Define and leverage intelligence metrics to measure operational effectiveness.

Service Improvement, Monitoring & Automation

• Develop and improve monitoring and detection capabilities based on threat research and investigation findings.
• Identify opportunities to automate detection, investigation, and response workflows.
• Drive improvements to security tools, processes, and service delivery.
• Develop and maintain incident response procedures, knowledge resources, and operational documentation.
• Lead lessons‑learned activities and tabletop exercises to strengthen operational readiness.

Customer Engagement & Technical Leadership

• Build strong relationships with customers and internal stakeholders, acting as a trusted technical advisor.
• Lead delivery projects, create and review technical deliverables, and present consulting recommendations.
• Collaborate with internal and external teams, including SOC Automation, Threat Intelligence, TAC, and Talos.
• Mentor and coach analysts, support new hires, and promote knowledge sharing across the team.
• Drive quality improvements through knowledge development, quality assurance, and reusable technical solutions, including scripts and standardized materials.
• Contribute to strategic initiatives and improvements across the wider CSOC organization.

Compliance & Organizational Responsibilities

• Support security audits and comply with company policies, processes, and CSOC standards.
• Contribute to organizational strategies and goals while maintaining the confidentiality and integrity of customer data.
• Meet established performance KPIs and quality expectations.

What We're Looking For

Education & Professional Experience

• Bachelor's degree in Computer Science or equivalent.
• Typically 5–8 years of relevant professional experience.
• Advanced degree is strongly preferred.

Technical Expertise

• Deep knowledge of Blue Team operations and cybersecurity technologies.
• Strong expertise in security monitoring, incident investigation, and response.
• Experience with threat intelligence, threat hunting, and malware analysis.
• Strong analytical, problem-solving, and troubleshooting skills.
• Ability to independently investigate and resolve highly complex cybersecurity issues.
• Experience leveraging software skills and tools to improve operational efficiency.

Communication & Customer Skills

• Excellent written and verbal communication and presentation skills.
• Strong customer consulting and stakeholder management skills.
• Ability to build relationships with customers, engineers, and senior management.
• Ability to work effectively in complex and ambiguous environments.

What We Expect at G10 Level

This is an expert-level role requiring significant independence, technical expertise, and leadership.

At this level, you will be expected to:

• Independently solve highly complex problems and identify innovative solutions with limited supervision.
• Make decisions that influence team performance, service quality, and cross-functional outcomes.
• Take ownership of delivery projects, scope, and technical deliverables, ensuring alignment with customer business objectives.
• Act as a trusted advisor, mentor, and technical leader for other analysts.
• Lead strategic and high‑visibility initiatives across the CSOC organization.
• Drive the development and adoption of improved solutions, delivery methods, automation, and reusable technical assets.
• Translate organizational goals into actionable priorities and deliver against established KPIs.