Senior Security Analyst

DOU; Wrocław; On-site; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Competitive compensation

Annual leave (20 or 26 days)

Private medical cover

Learning Hub

Gym & fitness membership

Multisport membership

Job summary

ARRISE is seeking an experienced Security Operations professional to join our global team in Wroclaw. You will drive incident response, threat hunting, and detection engineering across AWS, Azure, GCP, and on-prem systems, building robust playbooks and automations.

You’ll mentor analysts, report findings to stakeholders, and help reduce mean time to detect and respond. The role emphasizes proactive threat hunting, cloud security, and AI-enabled security workflows, with strong focus on detection

Qualifications

• 5+ years of experience in Security Operations, Incident Response, Threat Hunting, or Threat Detection, with enterprise SIEM work.
• Experience with SIEM query languages and developing or tuning SIEM/EDR detections.
• Knowledge of SOAR and vulnerability management technologies.
• Experience investigating incidents across AWS, Azure, GCP, and Microsoft 365.
• Experience with Linux; understanding Windows and container security concepts.
• Ability to operationalize threat intel into detection and response activities.
• Familiarity with Cyber Kill Chain and NIST CSF principles.
• Scripting experience with Python, PowerShell, or Bash.
• Strong analytical, investigative, and stakeholder-management skills.

Responsibilities

• Lead investigations into complex security incidents, including containment, eradication, and recovery.
• Coordinate cross-functional response activities and document lessons learned.
• Monitor, triage, and investigate alerts from SIEM, EDR, cloud, and other security platforms.
• Correlate telemetry to identify threats and improve visibility.
• Develop cloud-focused detection use cases and incident response procedures.
• Identify automation opportunities to improve SOC efficiency.
• Communicate findings and risks to technical and non-technical stakeholders.
• Mentor junior analysts and contribute to training.
• Track vulnerability remediation and provide risk-based prioritization.

Skills

Security Operations

Incident Response

Threat Hunting

Threat Detection

SIEM

EDR

SOAR

Python scripting

Cloud security

Linux

Windows security

Threat intelligence

Communication

Tools

Siem tooling

SOAR platforms

Job description

About us

ARRISE is a global leader in software development and services for the iGaming industry, bringing together more than 2,500 professionals operating across more than 12 locations worldwide.

From concept through to delivery, we combine technical expertise, creativity and industry knowledge to develop products, platforms and services that shape player experiences and support some of the industry's leading brands.

We are best known for the work we deliver for Pragmatic Play, creating and supporting technology, products and specialists services enjoyed by millions of players worldwide.

What you will do

Incident Response

• Lead investigations into complex security incidents, including containment, eradication, recovery, and root cause analysis.

• Coordinate cross-functional response activities, document lessons learned, and improve incident response procedures and playbooks.

Security Monitoring and Log Analysis

• Monitor, triage, and investigate alerts from SIEM, EDR, cloud, and other security platforms.

• Correlate endpoint, network, identity, cloud, and application telemetry to identify security threats.

• Integrate new log sources and improve security visibility across enterprise environments.

• Use automation and scripting to streamline analysis and investigation processes.

Threat Hunting and Detection Engineering

• Conduct proactive, hypothesis-driven threat hunting and translate findings into new detections, monitoring use cases, and response playbooks.

• Develop, test, maintain, and tune SIEM and EDR detections to improve accuracy and reduce alert fatigue.

• Identify detection gaps following incidents, threat intelligence reports, emerging attack trends, and validation exercises.

Cloud Security Monitoring

• Investigate cloud security events across AWS, Azure, and GCP, including privilege escalation, exposed resources, anomalous activity, and identity-related threats.

• Develop cloud-focused detection use cases and incident response procedures.

Security Automation and Detection Validation

• Identify automation opportunities that improve SOC efficiency and reduce Mean Time to Respond.

• Collaborate with Security Engineering, Infrastructure, and Red Team functions to validate detection coverage and response effectiveness.

Reporting, Mentorship and Training

• Communicate investigation findings, security trends, and risks to technical and non-technical stakeholders.

• Produce clear technical and executive-level incident reports with actionable recommendations.

• Mentor junior analysts and contribute to training, workshops, tabletop exercises, and knowledge-sharing activities.

Vulnerability and Threat Management

• Track vulnerability remediation and provide risk-based prioritization recommendations.

• Analyze and communicate vulnerability findings to relevant stakeholders.

• Collaborate with Infrastructure and Application teams to improve remediation effectiveness.

• Monitor relevant threat intelligence, including exploits, zero-day vulnerabilities, indicators of compromise, attacker techniques, and malware campaigns.

• Assess exposure to emerging threats and recommend appropriate mitigation, detection, and response actions.

AI in Security Operations

• Use AI-enabled security tools to improve SOC triage, investigations, threat hunting, detection development, reporting, and response workflows.

• Identify and investigate unauthorized or malicious use of AI services within the organization.

• Detect and respond to AI-assisted phishing, social engineering, malware, reconnaissance, and automated attacks.

What you bring

• 5+ years of experience in Security Operations, Incident Response, Threat Hunting, or Threat Detection, including at least 3 years working with enterprise SIEM platforms.

• Experience with SIEM query languages and developing or tuning SIEM and EDR detections.

• Working knowledge of SOAR and vulnerability management technologies.

• Experience investigating endpoint, network, identity, and cloud security incidents across AWS, Azure, GCP and Microsoft 365.

• Experience working with Linux and an understanding of Windows and container security concepts.

• Experience operationalizing threat intelligence into detection and response activities.

• Knowledge of Cyber Kill Chain and NIST Cybersecurity Framework principles.

• Practical scripting experience with Python, PowerShell, or Bash.

• Ability to work independently and make sound decisions during high-pressure incidents.

• Strong analytical, investigative, problem-solving, communication, and stakeholder-management skills.

• Familiarity with applying AI-enabled tools in Security Operations and with investigating malicious AI usage and AI-assisted attacks.

What sets you apart

• Relevant Microsoft Security certifications, such as SC-200, SC-100, or AZ-500.

• Relevant GIAC certifications, such as GCIH, GCFA, GCIA, GMON, or GREM.

• AWS Certified Security – Specialty.

What we offer

• Competitive compensation

• A competitive salary that reflects your skills and experience.

• Annual leave

• In accordance with the applicable legislation (20 or 26 days of annual leave).

• Private medical cover

• Private medical insurance to help you look after your health and wellbeing, available after successfully passing the probation period.

• Learning Hub

• Access to our online learning platform, with courses and resources to help you build your skills and grow your career.

• Gym & fitness membership

• Multisport membership, after successfully passing probation.