Senior AI-Driven Incident Response Lead

EY; Katowice; Vor Ort; PLN 180.000 - 300.000; Vollzeit

Benefits dieser Stelle

EY Badges – global certification of你的?

MBA title from Hult International

Career Counselor

Private healthcare

Life insurance

Tickets

Language learning platform

Sports cards

Zusammenfassung

EY Poland is seeking an experienced Incident Response Lead to independently manage high-severity cybersecurity incidents across endpoints, networks and cloud environments. You will guide triage, containment, eradication and recovery while mentoring junior analysts and developing incident response playbooks.

Working in EY.AI teams, you will apply MITRE ATT&CK frameworks, coordinate with SOC operations, and help strengthen detection capabilities through dashboards, tooling and post-incident

Qualifikationen

• Several years of professional experience in Incident Response, Security Operations Centre operations, Digital Forensics and Incident Response, threat hunting or cyber defence.
• Broad knowledge of network, endpoint, operating system, application, identity and data security.
• Advanced knowledge of incident investigation methodologies and the MITRE ATT&CK framework.
• Strong experience with SIEM, EDR/XDR, NDR, SOAR, detection and forensic tools.
• Strong knowledge of Windows, Linux, Active Directory, Microsoft Entra ID and network protocols.
• Experience in investigating phishing, ransomware, account compromise, application attacks and data exfiltration.
• Hands‑on experience with at least one major cloud platform, such as AWS, Microsoft Azure or Google Cloud.
• Experience in digital forensics, memory analysis, timeline analysis and evidence preservation.
• Experience in recovery activities, including secure service restoration, system rebuilds, backup validation and post-recovery monitoring.
• Strong communication skills and the ability to work effectively under pressure.

Aufgaben

• Independently leading the technical response to high-severity and critical cybersecurity incidents.
• Confirming the scope of an attack, level of compromise, attack vector, business impact and required response actions.
• Performing advanced analysis of endpoint, network, identity, application and cloud telemetry.
• Reconstructing attack paths and preparing detailed incident timelines.
• Conducting threat hunting based on indicators of compromise, attacker behaviours, tactics, techniques and procedures.
• Designing, recommending and overseeing containment and eradication activities.
• Analysing malware, scripts, processes, persistence mechanisms, lateral movement and privilege escalation.
• Performing root cause analysis and defining measures to prevent incident recurrence.
• Assessing the risks associated with restoring systems and services.
• Supporting decisions related to network segmentation, account and credential resets, system rebuilds, backup restoration and service recovery.
• Acting as the technical lead during major cybersecurity incidents.
• Mentoring Junior Incident Response Analysts.
• Developing, testing and improving incident response playbooks.
• Preparing the technical sections of post-incident reports and participating in post-incident reviews.

Kenntnisse

Incident Response

SOC operations

Digital Forensics

Threat hunting

MITRE ATT&CK

Cloud platforms

Windows/Linux

Network security

Communication under pressure

Tools

SIEM

EDR/XDR

NDR

SOAR

Jobbeschreibung

EY Poland is seeking an experienced Incident Response Lead to independently manage high-severity cybersecurity incidents across endpoints, networks and cloud environments. You will guide triage, containment, eradication and recovery while mentoring junior analysts and developing incident response playbooks.

Working in EY.AI teams, you will apply MITRE ATT&CK frameworks, coordinate with SOC operations, and help strengthen detection capabilities through dashboards, tooling and post-incident