Staff Security Engineer I, Poland

SHEIN; Kąty Wrocławskie; On-site; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Private medical care (Luxmed)

Life & health insurance

Multisport card

Lunch subsidies

Free parking

Training resources

Team-building activities

Job summary

SHEIN is seeking a SOC Security Operations Engineer to monitor, detect, investigate, and respond to security threats across IT and business systems. You will help build and improve detection and response capabilities within a follow-the-sun operating model, coordinating with Europe and APAC teams.

The role requires 5+ years in security operations, strong Python skills, and a practical understanding of intrusion techniques, log analysis, and web security; you will drive remediation and automation

Qualifications

• Bachelor's degree in Cyber security, Computer Science, or a related field with at least five years of hands-on security operations/incident response experience.
• Solid understanding of common attack techniques and defense strategies with core SOC skills in intrusion detection, malware analysis, log analysis, and threat hunting.
• Familiarity with log and alert analysis across OS, network protocols, cloud platforms, and security tooling, ability to distinguish real attacks from false positives.
• Proven security operations or incident response experience, able to perform alert analysis, attack-chain reconstruction, risk classification, remediation recommendations, post-incident reports, and detection-rule tuning.
• Working knowledge of web security vulnerabilities, with capability in pen testing, code review, or interface security testing, assess risks in backends, API gateways, authentication, and data flows.
• Proficiency in Python to write security detection scripts, log-analysis tools, and automation/triage utilities.
• Good English or Chinese reading, writing, and communication skills; able to work with cross-regional Europe/APAC teams and support global SOC shift work.

Responsibilities

• Own day-to-day SOC operations (24/7), building and running risk identification, monitoring, alerting, response, and post‑incident review.
• Contribute to the SOC roadmap and standards, drive detection rules, alert triage, incident response, knowledge management, and metrics.
• Monitor and triage security alerts focusing on intrusions, malware, anomalous logins, lateral movement, data exfiltration, and privilege abuse.
• Build and operate detection and response capabilities, including rules, use cases, SOPs, and automated remediation workflows.
• Perform pre‑production security assessments for third-party components and open-source software, delivering risk conclusions and remediation recommendations.
• Lead intrusion detection and incident response activities, including attack-chain reconstruction, impact analysis, and root-cause analysis.
• Stay current with threat intelligence and translate insights into operational detection rules and automation aligned to SOC scenarios.
• Collaborate with application, data security, platform engineering, IT, and business teams to improve security operations maturity.

Skills

Python proficiency

SOC operations

Threat hunting

Log analysis

Incident response

Cross-regional collaboration

English/Chinese communication

Education

Bachelor's degree in Cyber security or Computer Science

Tools

Security tooling

Job description

SHEIN is a global online fashion and lifestyle retailer, providing an extensive range of affordable, SHEIN-branded apparel and products sourced from a global network of vendors. Since our founding in 2012, we have expanded to serve customers in over 160 countries worldwide. Our EMEA headquarters are in Dublin, and we now operate over 15 offices across the EMEA region.

At SHEIN, our culture is driven by our core values: Customer First, Take Ownership, Deliver Results, Make Change, and Celebrate Diversity. These are not just words, they are the principles that guide our work as we strive to meet the needs of our customers around the world.

Learn more about SHEIN by following us at https://careers.shein.com/ and Homepage - SHEIN Group.

Position Summary

As a SOC Security Operations Engineer, you will be part of our global security operations function, responsible for monitoring, detecting, investigating, and responding to security threats across the company's IT and business systems. You will help build and continuously improve our detection and response capabilities as part of an aligned, follow-the-sun operating model.

Key Responsibilities

• Own day-to-day security operations (SOC), building and running the mechanisms for risk identification, monitoring, alerting, response, and post-incident review, supporting 7×24 security operations coverage.
• Contribute to the security operations roadmap and standards, driving security risks into a unified operations framework covering log onboarding, detection rules, alert triage, incident response, knowledge management, and operational metrics.
• Perform continuous monitoring and triage of security alerts, with a focus on intrusion attempts, malware, anomalous logins, lateral movement, data exfiltration, and privilege abuse.
• Build and operate detection and response capabilities, including detection rules, attack samples, evaluation use cases, response SOPs, and automated remediation workflows, improving the SOC's ability to detect, analyze, and close out security incidents.
• Conduct pre-production security assessments and operational readiness checks for third-party components, open-source software, and systems going live, delivering risk conclusions, remediation recommendations, and post-launch monitoring requirements.
• Participate in intrusion detection and incident response, performing attack-chain reconstruction, impact analysis, forensics, and root-cause analysis, and driving vulnerability remediation and continuous monitoring.
• Stay current with developments in security offense/defense, threat intelligence, and detection engineering, translating them into operational detection rules, triage logic, and automation capabilities aligned to real SOC scenarios.
• Collaborate with application security, data security, platform engineering, IT, and business teams to drive the detection, classification, response, review, and knowledge capture of security incidents, continuously improving security operations maturity and metrics.

Qualifications and Experience

• Bachelor's degree or above in Cyber security, Computer Science, or a related field, with at least five years hands-on experience in security operations (SOC), incident response, or application security.
• Solid understanding of common attack techniques and defense strategies, with core SOC skills in intrusion detection, malware analysis, log analysis, and threat hunting.
• Familiarity with log and alert analysis across mainstream operating systems, network protocols, cloud platforms, and common security tooling, with the ability to distinguish real attacks from false positives.
• Proven security operations or incident response experience, able to independently perform alert analysis, attack-chain reconstruction, risk classification, remediation recommendations, post-incident reports, and detection-rule tuning.
• Working knowledge of common web security vulnerabilities, with some capability in penetration testing, code review, or interface security testing, able to assess risks in application backends, API gateways, authentication, and data flows.
• Proficiency in Python, able to write security detection scripts, log-analysis scripts, and automation/triage tools.
• Good English or Chinese reading, writing, and communication skills, able to collaborate within cross-regional (Europe / APAC) teams; comfortable with global SOC shift work or cross-time-zone collaboration.

What We Offer:

• Globally diverse team;
• Full-time contract structure: 3-month probation, then 1-year fixed-term, followed by a permanent contract;
• Clear promotion path;
• Performance-driven yearly bonus;
• Unlimited access to company training and learning resources;
• No formal dress code — wear what makes you comfortable.
• Private medical care at Luxmed;
• Fully employer-funded life & health insurance at Nationale-Nederlander;
• Multisport card;
• Subsidized lunches for 1 PLN (meat, vegetarian, or Chinese options);
• Free parking;
• Company benefit fund;
• Employee referral program;
• Multiple team-building activities throughout the year;
• Fruits and healthy snacks at work.

Please note that pay information, including salary bands, will be shared with candidates upon invitation to the first interview.

Please note that the final salary offered within the stated range will be determined following a thorough assessment of a candidate's overall profile, including but not limited to qualifications for the role, technical and soft skills, and level of experience.