Security Operations Engineer II: 24/7 SOC & Incident Response

Coreweave; Warszawa; On-site; PLN 189,000 - 252,000; Full time

Benefits offered by this job

Family-level Medical Insurance

Family-level Dental Insurance

Generous Pension Contribution

Life Assurance at 4x Salary

Critical Illness Cover

Employee Assistance Programme

Tuition Reimbursement

Work culture focused on innovation

Job summary

CoreWeave is seeking a Security Operations Engineer II for its 24x7 Security Operations Center in Warsaw, Poland. You will perform triage, initial investigation, and first-line incident response on security events under guidance from senior engineers.

You will work across Linux, MacOS, and Kubernetes environments, using SIEM/EDR and other tools to detect and respond in real time while contributing to detections and runbooks.

Qualifications

• Requires degree in CS/Security or equivalent
• 1–2+ years in security operations, SOC analysis, incident response, or related field
• Strong knowledge of Linux and MacOS logging and forensics

Responsibilities

• Triage and respond to security alerts using playbooks across Linux, MacOS, and Kubernetes
• Escalate complex incidents to senior engineers
• Use SIEM/EDR and other tools to detect, investigate, and respond in real time
• Contribute to post-incident reviews and runbooks
• Document investigations thoroughly and keep SOPs up to date
• Collaborate with threat intel and detection teams
• Participate in on-call rotation for 24x7 SOC
• Build skills across threat landscape and CoreWeave env

Skills

Linux

MacOS

Kubernetes

SIEM

EDR

IDS/IPS

Firewalls

Analytical skills

Communication

On-call support

Education

Bachelor's degree in CS/Cyber Security

Tools

SIEM

EDR

IDS/IPS

Firewalls

Kubernetes

Job description

CoreWeave is seeking a Security Operations Engineer II for its 24x7 Security Operations Center in Warsaw, Poland. You will perform triage, initial investigation, and first-line incident response on security events under guidance from senior engineers.

You will work across Linux, MacOS, and Kubernetes environments, using SIEM/EDR and other tools to detect and respond in real time while contributing to detections and runbooks.