Senior Threat Detection & Response Engineer – Multicloud Security

Ryanair Group Holdings; Wrocław; On-site; PLN 180,000 - 300,000; Full time

Benefits offered by this job

Staff travel benefits

Multisport card

Training & certifications

Office events

Referral program

Job summary

Ryanair Labs, the technology brand of Ryanair, is hiring an Information Security – Senior Threat Detection & Response Engineer in Wroclaw. This hands-on role focuses on proactively identifying telemetry gaps, validating controls across on-prem, endpoints, and multicloud environments, and contributing to incident response.

You’ll map telemetry to MITRE ATT&CK, develop detections as code, and work with platform owners to implement preventive controls and improve coverage and response

Qualifications

• Hands-on detection engineering and incident response experience.
• Proficient with multiple SIEM/EDR tools and cloud security telemetry.
• Experience in detecting and closing coverage gaps with MITRE ATT&CK mapping.

Responsibilities

• Own detection and visibility across AWS, GCP and Azure control planes.
• Run purple-team exercises and convert findings into detections and mitigations.
• Hunt for uncovered techniques and drive incident containment and recovery.

Skills

Detection engineering

SIEM skills

EDR experience

Sigma rules

Multicloud security

MITRE ATT&CK

Python or PowerShell

Git & CI

LLM tooling

Incident communication

Tools

KQL

SPL

ELK/Elastic

OpenSearch

CloudTrail

GuardDuty

Azure Activity Logs

Entra ID logs

Job description

Ryanair Labs, the technology brand of Ryanair, is hiring an Information Security – Senior Threat Detection & Response Engineer in Wroclaw. This hands-on role focuses on proactively identifying telemetry gaps, validating controls across on-prem, endpoints, and multicloud environments, and contributing to incident response.

You’ll map telemetry to MITRE ATT&CK, develop detections as code, and work with platform owners to implement preventive controls and improve coverage and response