Senior Security Analyst

ARRISE; Polska; On-site; PLN 180,000 - 260,000; Full time

Benefits offered by this job

Competitive compensation

Annual leave

Private medical cover

Learning Hub

Gym membership

Job summary

ARRISE is seeking an experienced Security Operations professional to lead complex incident investigations, coordinate cross-functional response, and improve detection across SIEM, EDR, and cloud platforms. The role emphasizes automation, mentoring, and clear reporting to stakeholders.

You will work with Linux/Windows environments, develop detections, and drive vulnerability management and threat intelligence integration to strengthen overall security posture.

Qualifications

• 5+ years of experience in Security Operations, Incident Response, Threat Hunting, or Threat Detection.
• Experience with SIEM query languages and developing or tuning SIEM and EDR detections.
• Working knowledge of SOAR and vulnerability management technologies.

Responsibilities

• Lead investigations into complex security incidents including containment, eradication, recovery, and root cause analysis.
• Coordinate cross-functional response activities and document lessons learned.
• Monitor, triage, and investigate alerts from SIEM, EDR, cloud, and other security platforms.
• Correlate endpoint, network, identity, cloud, and application telemetry to identify security threats.
• Develop and tune SIEM and EDR detections to improve accuracy.
• Investigate cloud security events across AWS, Azure, and GCP.
• Drive security automation and use scripting to streamline workflows.
• Mentor junior analysts and contribute to training and drills.
• Communicate findings and risks to technical and executive stakeholders.
• Track vulnerability remediation and prioritize actions.

Skills

Security Operations

Incident Response

Threat Hunting

Threat Detection

SIEM platforms

SOAR

Vulnerability management

Python

PowerShell

Bash

Linux

Windows

Communication

Stakeholder management

Tools

SIEM

EDR

SOAR

Cloud security tools

Python

PowerShell

Bash

Job description

What you will do

Incident Response

• Lead investigations into complex security incidents, including containment, eradication, recovery, and root cause analysis.
• Coordinate cross-functional response activities, document lessons learned, and improve incident response procedures and playbooks.

Security Monitoring and Log Analysis

• Monitor, triage, and investigate alerts from SIEM, EDR, cloud, and other security platforms.
• Correlate endpoint, network, identity, cloud, and application telemetry to identify security threats.
• Integrate new log sources and improve security visibility across enterprise environments.
• Use automation and scripting to streamline analysis and investigation processes.

Threat Hunting and Detection Engineering

• Conduct proactive, hypothesis-driven threat hunting and translate findings into new detections, monitoring use cases, and response playbooks.
• Develop, test, maintain, and tune SIEM and EDR detections to improve accuracy and reduce alert fatigue.
• Identify detection gaps following incidents, threat intelligence reports, emerging attack trends, and validation exercises.

Cloud Security Monitoring

• Investigate cloud security events across AWS, Azure, and GCP, including privilege escalation, exposed resources, anomalous activity, and identity-related threats.
• Develop cloud-focused detection use cases and incident response procedures.

Security Automation and Detection Validation

• Identify automation opportunities that improve SOC efficiency and reduce Mean Time to Respond.
• Collaborate with Security Engineering, Infrastructure, and Red Team functions to validate detection coverage and response effectiveness.

Reporting, Mentorship and Training

• Communicate investigation findings, security trends, and risks to technical and non-technical stakeholders.
• Produce clear technical and executive-level incident reports with actionable recommendations.
• Mentor junior analysts and contribute to training, workshops, tabletop exercises, and knowledge-sharing activities.

Vulnerability and Threat Management

• Track vulnerability remediation and provide risk-based prioritization recommendations.
• Analyze and communicate vulnerability findings to relevant stakeholders.
• Collaborate with Infrastructure and Application teams to improve remediation effectiveness.
• Monitor relevant threat intelligence, including exploits, zero-day vulnerabilities, indicators of compromise, attacker techniques, and malware campaigns.
• Assess exposure to emerging threats and recommend appropriate mitigation, detection, and response actions.

AI in Security Operations

• Use AI-enabled security tools to improve SOC triage, investigations, threat hunting, detection development, reporting, and response workflows.
• Identify and investigate unauthorized or malicious use of AI services within the organization.
• Detect and respond to AI-assisted phishing, social engineering, malware, reconnaissance, and automated attacks.

What you bring

• 5+ years of experience in Security Operations, Incident Response, Threat Hunting, or Threat Detection, including at least 3 years working with enterprise SIEM platforms.
• Experience with SIEM query languages and developing or tuning SIEM and EDR detections.
• Working knowledge of SOAR and vulnerability management technologies.
• Experience investigating endpoint, network, identity, and cloud security incidents across AWS, Azure, GCP, and Microsoft 365.
• Experience working with Linux and an understanding of Windows and container security concepts.
• Experience operationalizing threat intelligence into detection and response activities.
• Knowledge of Cyber Kill Chain and NIST Cybersecurity Framework principles.
• Practical scripting experience with Python, PowerShell, or Bash.
• Ability to work independently and make sound decisions during high-pressure incidents.
• Strong analytical, investigative, problem-solving, communication, and stakeholder-management skills.
• Familiarity with applying AI-enabled tools in Security Operations and with investigating malicious AI usage and AI-assisted attacks.

What sets you apart

• Relevant Microsoft Security certifications, such as SC-200, SC-100, or AZ-500.
• Relevant GIAC certifications, such as GCIH, GCFA, GCIA, GMON, or GREM.
• AWS Certified Security – Specialty.

What we offer

• Competitive compensation
  • A competitive salary that reflects your skills and experience.
• Annual leave
  • In accordance with the applicable legislation (20 or 26 days annual leave).
• Private medical cover
  • Private medical insurance to help you look after your health and wellbeing, available after successfully passing the probation period.
• Learning Hub
  • Access to our online learning platform, with courses and resources to help you build your skills and grow your career.
• Gym & fitness membership
  • Multisport membership, after successfully passing probation.

About us

ARRISE is a global leader in software development and services for the iGaming industry, bringing together more than 2,500 professionals operating across more than 12 locations worldwide.

From concept through to delivery, we combine technical expertise, creativity and industry knowledge to develop products, platforms and services that shape player experiences and support some of the industry's leading brands.

We are best known for the work we deliver for Pragmatic Play, creating and supporting technology, products and specialists services enjoyed by millions of players worldwide.