Senior Multicloud Threat Detection & Response Engineer

Ryanair Ltd.; Wrocław; Hybrid; PLN 180,000 - 280,000; Full time

Benefits offered by this job

Hybrid model

Staff travel benefits

Multisport card

Training opportunities

Office in city centre

Job summary

Ryanair Labs is hiring a hands-on Information Security – Senior Threat Detection & Response Engineer to join Europe’s largest airline group. You will map telemetry to MITRE ATT&CK, run adversary emulation, and close gaps across AWS, GCP, and Azure with detections as code.

You will onboard log sources, tune detections, and lead incident containment and recovery, using Python/PowerShell and CI workflows to ensure rapid, validated outcomes.

Qualifications

• 6+ years in detection engineering or senior SOC
• Hands-on SIEM expertise (Sentinel, Splunk, Elastic/OpenSearch)
• EDR experience (Defender, SentinelOne, CrowdStrike)
• Sigma rule authoring and testing
• Multicloud security across AWS, GCP and Azure
• Adversary emulation / breach-and-attack-simulation
• Python or PowerShell with version control
• Use of LLM tools for automation with validation

Responsibilities

• Own detection and visibility across AWS, GCP and Azure control planes
• Run purple-team exercises; translate findings into detections
• Hunt for uncovered techniques using the coverage map
• Lead containment, eradication and recovery during incidents
• Automate enrichment, triage and response (SOAR, scripts)
• Produce ATT&CK coverage and gap-closure metrics for leadership

Skills

Detection engineering

Incident response

MITRE ATT&CK

Python

PowerShell

Git & CI

Cloud security

Adversary emulation

SIEM

Tools

Microsoft Sentinel

Splunk

Elastic / OpenSearch

Sigma

Job description

Ryanair Labs is hiring a hands-on Information Security – Senior Threat Detection & Response Engineer to join Europe’s largest airline group. You will map telemetry to MITRE ATT&CK, run adversary emulation, and close gaps across AWS, GCP, and Azure with detections as code.

You will onboard log sources, tune detections, and lead incident containment and recovery, using Python/PowerShell and CI workflows to ensure rapid, validated outcomes.