Senior Information Security Analyst – GRC & AppSec

EY; Katowice; Hybrid; PLN 140,000 - 210,000; Full time

Job summary

EY GDS Poland is seeking an Information Security Analyst – Supervising Associate to join the Technology Assurance, Risk, and Policy team. The role involves conducting security reviews, coordinating cyber assessments, and supporting secure product delivery in a hybrid model (2 days in office, 3 days remote) in Wrocław or Katowice.

You will work with experts across application and network security, PCI/ISO frameworks, and third‑party attestations, pushing for secure practices and risk‑driven

Qualifications

• 5–8 years of experience in application security assessment.
• Hands-on experience with web, thick client and mobile application security reviews.
• Knowledge of manual testing methodologies and vulnerability assessment.
• Understanding of security controls like firewalls, IDS/IPS, and encryption.
• Ability to communicate risk and remediation to technical and non‑technical stakeholders.

Responsibilities

• Prepare detailed security review reports and remediation guidance.
• Research new application security vulnerabilities and attack vectors.
• Lead strategic initiatives and mentor new team members.
• Automate scanning processes within the CI/CD pipeline for continuous security testing.
• Collaborate with development teams to address scan results and prioritize remediations.

Skills

Web security testing

Thick client testing

Mobile security testing

VOIP security testing

Wireless security testing

Manual & automated testing

Security concepts communication

Education

Bachelor's degree in Information Technology or Cyber Security

Tools

Burp Professional

Nmap

Wireshark

Nessus

WebInspect

Qualys WAS

Checkmarx

WhiteSource

Job description

EY GDS Poland is seeking an Information Security Analyst – Supervising Associate to join the Technology Assurance, Risk, and Policy team. The role involves conducting security reviews, coordinating cyber assessments, and supporting secure product delivery in a hybrid model (2 days in office, 3 days remote) in Wrocław or Katowice.

You will work with experts across application and network security, PCI/ISO frameworks, and third‑party attestations, pushing for secure practices and risk‑driven