Senior Cyber Incident Response Lead & Threat Hunter

EY; Kraków; On-site; PLN 180,000 - 240,000; Full time

Benefits offered by this job

EY Badges

Career Counselor

Private healthcare

MBA from Hult (via EY)

Psycho-educational platform

Job summary

EY Poland is seeking a seasoned Incident Response professional to lead technical responses to high-severity security incidents across endpoints, networks, identities, applications and cloud environments.

You will guide triage, containment, eradication, secure recovery and root-cause analysis, while strengthening incident response playbooks and detection capabilities. Mentoring junior analysts is a key part of the role.

Qualifications

• Several years of professional experience in Incident Response, SOC operations, digital forensics and threat hunting.
• Broad knowledge of network, endpoint, OS, application, identity and data security.
• Advanced knowledge of incident investigation methodologies and MITRE ATT&CK framework.
• Strong experience with SIEM, EDR/XDR, NDR, SOAR and forensic tools.

Responsibilities

• Lead technical response to high-severity incidents.
• Confirm attack scope, compromise level, vectors and required actions.
• Analyze endpoint, network, identity, app and cloud telemetry.
• Reconstruct attack paths and prepare incident timelines.
• Conduct threat hunting based on IOC and attacker TTPs.
• Oversee containment and eradication activities.
• Analyze malware, scripts, persistence, lateral movement and privilege escalation.
• Perform root cause analysis and preventive measures.
• Assess risks of restoring systems and services.
• Support network segmentation and system rebuild decisions.
• Act as technical lead during major incidents.
• Mentor junior Incident Response Analysts.
• Develop, test and improve incident response playbooks.
• Prepare technical sections of post-incident reports.

Skills

Incident Response

Security Operations Center

Digital Forensics

Threat Hunting

MITRE ATT&CK

Cloud Security

Tools

SIEM

EDR/XDR

NDR

SOAR

Forensic Tools

Job description

EY Poland is seeking a seasoned Incident Response professional to lead technical responses to high-severity security incidents across endpoints, networks, identities, applications and cloud environments.

You will guide triage, containment, eradication, secure recovery and root-cause analysis, while strengthening incident response playbooks and detection capabilities. Mentoring junior analysts is a key part of the role.