Senior Cyber Security Incident Responder

Orsted Asia Pacific; Warszawa; Híbrido; PLN 180.000 - 230.000; Jornada completa

Descripción de la vacante

Ørsted is seeking a skilled cyber security incident responder to lead investigations across global IT and OT environments. You will analyze logs, forensic data, and security telemetry to determine root causes and impact, coordinating response with cross-functional teams and external partners.

The role emphasizes threat hunting, digital forensics, and continuous improvement of incident response playbooks, with on-call duties to ensure readiness beyond standard hours.

Formación

• Strong hands-on experience investigating and responding to cyber security incidents, including containment, root cause analysis, and coordination of response activities.
• Deep technical knowledge of computer systems, networks, endpoints, and cyber security, and the ability to investigate complex incidents methodically using various sources of technical evidence.
• Experience with security monitoring and investigation technologies such as SIEM, XDR or EDR, and the ability to analyze logs and other data.
• Experience with threat hunting, digital forensics, or related investigative activities, and the ability to convert findings into practical improvements.
• Ability to communicate complex technical issues clearly to technical colleagues and senior stakeholders, especially under pressure.
• Work independently, prioritize during incidents, share knowledge, and continually develop cyber security expertise.

Responsabilidades

• Lead and carry out technical investigations of cyber security incidents across global IT and OT environments.
• Analyze logs, network and endpoint data, forensic evidence, and other technical information to establish root cause, scope, and impact.
• Coordinate incident response across technical teams and translate findings into clear information and recommendations for stakeholders.
• Design and carry out intelligence-led threat hunting and forensic investigations.
• Document investigations, lessons learned, and incident timelines, and continuously improve incident response playbooks and procedures.
• Participate in a compensated, rotating on-call scheme to maintain readiness to respond outside normal hours.

Conocimientos

Incident response

Digital forensics

Threat hunting

Root cause analysis

SIEM/XDR/EDR

Log analysis

Communication

Team collaboration

On-call readiness

Herramientas

SIEM

XDR

EDR

Descripción del empleo

Join us in this role where you’ll lead and investigate cyber security incidents across IT and OT environments. You’ll use your deep technical expertise to understand what happened, determine the root cause and impact, coordinate an effective response, and turn complex findings into clear recommendations for stakeholders. You’ll also help develop our threat hunting, forensic investigation, and incident response capabilities.

Welcome to Cyber Defence Centre

You’ll be part of Cyber Defence Centre where you, together with your colleagues, will act as the final escalation point when Ørsted faces a cyber security incident. You’ll work across IT and OT environments and collaborate with security specialists, technical teams, external partners, and other stakeholders to investigate and coordinate our response to cyber threats.

As a team, we work closely, share what we learn, and continuously strengthen how we respond. Between incidents, you’ll have the freedom to deepen your expertise through threat hunting, exercises, developing tools and methodologies, and improving how the team operates.

You’ll play an important role in:

• leading and carrying out technical investigations of cyber security incidents across global IT and OT environments
• analyzing logs, network and endpoint data, forensic evidence, and other technical information to establish root cause, scope, and impact
• coordinating incident response across technical teams and translating complex findings into clear information and recommendations for stakeholders
• designing and carrying out intelligence‑led threat hunting and forensic investigations
• documenting investigations, lessons learned, and incident timelines, and continuously improving incident response playbooks and procedures
• taking part in a compensated, rotating on‑call scheme that maintains the team’s readiness to respond to significant cyber security incidents outside normal working hours.

To succeed in the role, you:

• have strong hands‑on experience investigating and responding to cyber security incidents, including containment, root cause analysis, and coordination of response activities
• have deep technical knowledge of computer systems, networks, endpoints, and cyber security, and can investigate complex incidents methodically using different sources of technical evidence
• are experienced with security monitoring and investigation technologies such as SIEM, XDR or EDR, and can confidently analyses logs and other technical data
• have experience with threat hunting, digital forensics, or related investigative activities, and can turn findings into practical improvements
• communicate complex technical issues clearly and confidently to both technical colleagues and senior stakeholders, including when decisions need to be made under pressure
• work independently, prioritize effectively during incidents, share your knowledge with colleagues, and have a strong interest in continually developing your cyber security expertise.