Senior Threat Detection & Response Engineer - Cloud & IR

Ryanair - Europe's Favourite Airline; Wrocław; Hybrid; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Staff travel benefits from day one

Multisport card

Private health care

Group insurance scheme

Job summary

Ryanair Labs is hiring a Senior Information Security Engineer focused on Threat Detection & Response. You will proactively identify gaps in telemetry and detections across on-prem, endpoints and multicloud environments (AWS, GCP, Azure), closing them with evidence-backed fixes.

You’ll participate in incident response, lead containment and recovery, and automate detection and response using code and CI/CD practices. Hybrid work options apply.

Qualifications

• 6+ years hands-on in detection engineering, senior SOC analyst or incident response.
• Hands-on SIEM skills: Microsoft Sentinel, Splunk, Elastic/OpenSearch.
• Multicloud security across AWS, GCP and Azure with telemetry and IAM considerations.
• Practical MITRE ATT&CK usage for coverage assessment and threat mapping.

Responsibilities

• Own detection and visibility across AWS, GCP and Azure control planes and identity." audit-log ingestion, native security-service alerts, and misconfiguration findings feeding the gap backlog.
• Run purple-team exercises with red-team/pentest partners and convert findings into detections and mitigations.
• Hunt proactively for techniques the coverage map shows as uncovered.
• Lead containment, eradication and recovery during incidents; perform forensic analysis; feed lessons back into the backlog.
• Automate enrichment, triage and response (SOAR, Python, PowerShell) to remove manual toil.
• Use LLM assistants and agentic coding tools to speed up rule authoring and testing, with validation before production.
• Produce coverage and performance metrics (ATT&CK coverage, gap closure, MTTD/MTTR) for leadership.

Skills

Threat detection

Incident response

MITRE ATT&CK

Cloud security

Threat hunting

Python/PowerShell

Tools

Microsoft Sentinel

Splunk

Elastic/OpenSearch

Sigma

Microsoft Defender

CrowdStrike

SentinelOne

Job description

Ryanair Labs is hiring a Senior Information Security Engineer focused on Threat Detection & Response. You will proactively identify gaps in telemetry and detections across on-prem, endpoints and multicloud environments (AWS, GCP, Azure), closing them with evidence-backed fixes.

You’ll participate in incident response, lead containment and recovery, and automate detection and response using code and CI/CD practices. Hybrid work options apply.