Senior Incident Response Analyst

EY; Województwo mazowieckie; On-site; PLN 180,000 - 320,000; Full time

Benefits offered by this job

EY Badges

MBA title from Hult

Career Counselor

Private healthcare

Life insurance

Tickets

Team sports

Language learning platform

Sports cards

Job summary

EY Poland is seeking a seasoned Incident Response Lead to join EY.AI's cybersecurity team. You will guide technical responses to high-severity incidents, conduct root cause analyses and help mature playbooks across endpoints, networks, cloud and identity environments.

The role emphasizes mentoring juniors, collaborating with cross-functional teams, and delivering post-incident reports while upholding EY's security standards.

Qualifications

• Several years of professional experience in Incident Response, Security Operations Centre operations, Digital Forensics and Incident Response, threat hunting or cyber defence.
• Broad knowledge of network, endpoint, operating system, application, identity and data security.
• Advanced knowledge of incident investigation methodologies and the MITRE ATT&CK framework.
• Strong experience with SIEM, EDR/XDR, NDR, SOAR, detection and forensic tools.
• Strong knowledge of Windows, Linux, Active Directory, Microsoft Entra ID and network protocols.
• Experience in investigating phishing, ransomware, account compromise, application attacks and data exfiltration.
• Hands-on experience with at least one major cloud platform, such as AWS, Microsoft Azure or Google Cloud.
• Experience in digital forensics, memory analysis, timeline analysis and evidence preservation.
• Experience in recovery activities, including secure service restoration, system rebuilds, backup validation and post-recovery monitoring.
• Strong communication skills and the ability to work effectively under pressure.

Responsibilities

• Independently leading the technical response to high-severity and critical cybersecurity incidents.
• Confirming the scope of an attack, level of compromise, attack vector, business impact and required response actions.
• Performing advanced analysis of endpoint, network, identity, application and cloud telemetry.
• Reconstructing attack paths and preparing detailed incident timelines.
• Conducting threat hunting based on indicators of compromise, attacker behaviours, tactics, techniques and procedures.
• Designing, recommending and overseeing containment and eradication activities.
• Analysing malware, scripts, processes, persistence mechanisms, lateral movement and privilege escalation.
• Performing root cause analysis and defining measures to prevent incident recurrence.
• Assessing the risks associated with restoring systems and services.
• Supporting decisions related to network segmentation, account and credential resets, system rebuilds, backup restoration and service recovery.
• Acting as the technical lead during major cybersecurity incidents.
• Developing, testing and improving incident response playbooks.
• Preparing the technical sections of post-incident reports and participating in post-incident reviews.

Skills

Incident Response

Threat Hunting

Digital Forensics

Cyber Defence

Communication Skills

Ability to work under pressure

Tools

SIEM

EDR/XDR

NDR

SOAR

Forensic Tools

Windows

Linux

Active Directory

Microsoft Entra ID

Network Protocols

Cloud Platforms (AWS/Azure/GCP)

Job description

Join a cybersecurity team responsible for investigating and responding to complex security incidents across endpoint, network, identity, application and cloud environments. In this role, you will lead the technical response to high-severity incidents, from initial triage and containment through eradication, secure recovery and root cause analysis. You will also help strengthen the Incident Response capability by developing playbooks, sharing expertise and mentoring junior team members.

EY.AI – in this role, you will work in an environment where AI agents are part of the team and everyday project work. You will use solutions tailored to specific areas that support data analysis, recommendation development and solution design. This will help you move more quickly from analysis to action and create value for clients.

Your scope of duties

• Independently leading the technical response to high-severity and critical cybersecurity incidents.
• Confirming the scope of an attack, level of compromise, attack vector, business impact and required response actions.
• Performing advanced analysis of endpoint, network, identity, application and cloud telemetry.
• Reconstructing attack paths and preparing detailed incident timelines.
• Conducting threat hunting based on indicators of compromise, attacker behaviours, tactics, techniques and procedures.
• Designing, recommending and overseeing containment and eradication activities.
• Analysing malware, scripts, processes, persistence mechanisms, lateral movement and privilege escalation.
• Performing root cause analysis and defining measures to prevent incident recurrence.
• Assessing the risks associated with restoring systems and services.
• Supporting decisions related to network segmentation, account and credential resets, system rebuilds, backup restoration and service recovery.
• Acting as the technical lead during major cybersecurity incidents.
• Developing, testing and improving incident response playbooks.
• Preparing the technical sections of post-incident reports and participating in post-incident reviews.

Our requirements

• Several years of professional experience in Incident Response, Security Operations Centre operations, Digital Forensics and Incident Response, threat hunting or cyber defence.
• Broad knowledge of network, endpoint, operating system, application, identity and data security.
• Advanced knowledge of incident investigation methodologies and the MITRE ATT&CK framework.
• Strong experience with SIEM, EDR/XDR, NDR, SOAR, detection and forensic tools.
• Strong knowledge of Windows, Linux, Active Directory, Microsoft Entra ID and network protocols.
• Experience in investigating phishing, ransomware, account compromise, application attacks and data exfiltration.
• Hands-on experience with at least one major cloud platform, such as AWS, Microsoft Azure or Google Cloud.
• Experience in digital forensics, memory analysis, timeline analysis and evidence preservation.
• Experience in recovery activities, including secure service restoration, system rebuilds, backup validation and post-recovery monitoring.
• Strong communication skills and the ability to work effectively under pressure.

What we offer

• Participation in projects addressing complex cybersecurity incidents across diverse technology environments.
• Access to advanced security technologies and opportunities to further develop expertise in Incident Response, threat hunting and digital forensics.
• A role with a real impact on the development of incident response playbooks, investigation standards and the broader Incident Response capability.
• Professional and financial support in obtaining recognised qualifications and certificates.
• EY Badges – global certification of your competencies and the opportunity to earn an MBA title from the prestigious Hult International School of Business.
• Career Counselor – professional, one-to-one guidance on career building and development.
• Psycho-educational platform – a package of free consultations with specialists in the broad field of mental health and personal development and access to educational activities.
• Benefit programme offering private healthcare with additional preventive examinations, life insurance, tickets, team sports, a language learning platform, sports cards and much more, available online and offline.

About EY Poland

We are a global consulting and technology company.

We make a difference by transforming and changing services, products, organisations and even the rules of the game. We combine business and technology, using artificial intelligence and real talent. We help organisations solve complex problems, make better decisions and implement changes for the better.

We provide confidence in data, opinions, standards, technology and security.

Every day, we take on challenges, analyse opportunities, create prompts, conduct research, collaborate, ask the right questions, plan, model, code, try new things and draw conclusions. We create solutions that are crucial for our clients.

This is where friendships, relationships and lifelong memories are made.

This is where you do difficult and important things with supportive and exceptional people.

We care about the environment, not only the business environment. As part of our established plan, we have reduced global greenhouse gas emissions by 40% compared with the 2019 baseline.

EY is an equal opportunities employer. We value and promote the diversity of knowledge, experience and perspectives within our community. We create an environment based on respect, openness and collaboration, where everyone can develop and make a real impact. We run the “Poziom Wyżej bez Barier” programme, which supports employees with disabilities in pursuing their ambitions and professional development goals.

EY provides equal opportunities to all candidates throughout the recruitment process, regardless of sex, age, race, religion, sexual orientation, origin, disability or any other legally protected characteristic, in accordance with applicable law.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.