Staff Security Operations Enigneer

SHEIN; Wrocław; On-site; PLN 140,000 - 200,000; Full time

Job summary

SHEIN is seeking a SOC Security Operations Engineer in Wrocław to monitor, detect, investigate, and respond to security threats across IT systems. You will help build detection and response capabilities and support round-the-clock operations.

The role requires 5+ years in security operations, strong intrusion detection and log analysis skills, and proficiency in Python for automation. English or Chinese communication is valuable for cross-regional collaboration.

Qualifications

• Bachelor's degree or higher in cyber security, CS, or related field.
• At least five years hands-on security operations, SOC, or incident response.
• Solid understanding of attack techniques and defense strategies, with SOC skills.
• Experience with log/alert analysis across OS, networks, and cloud.
• Ability to perform alert analysis, attack-chain reconstruction, and remediation.
• Experience with web security vulnerabilities, app security testing, and API security.
• Proficient in Python for scripting security detections and automation.
• Strong English or Chinese reading/writing for cross-regional collaboration.

Responsibilities

• Own day-to-day security operations, providing 24/7 coverage.
• Develop and maintain detection rules, SOPs, and automation workflows.
• Monitor, triage, and respond to security alerts and incidents.
• Conduct intrusion analysis, forensics, and root-cause investigations.
• Collaborate with app security, data security, and IT teams.
• Perform pre-production security assessments of third-party components.
• Translate threat intelligence into actionable detection rules.

Skills

SOC operations

Incident response

Threat hunting

Log analysis

Malware analysis

Intrusion detection

Python scripting

Cross-regional collaboration

Education

Bachelor's degree in Cyber security or related field

Tools

Security tooling

Job description

Mile widziane:

Qualifications and Experience

• Bachelor's degree or above in Cyber security, Computer Science, or a related field, with at least five years hands-on experience in security operations (SOC), incident response, or application security.
• Solid understanding of common attack techniques and defense strategies, with core SOC skills in intrusion detection, malware analysis, log analysis, and threat hunting.
• Familiarity with log and alert analysis across mainstream operating systems, network protocols, cloud platforms, and common security tooling, with the ability to distinguish real attacks from false positives.
• Proven security operations or incident response experience, able to independently perform alert analysis, attack-chain reconstruction, risk classification, remediation recommendations, post-incident reports, and detection-rule tuning.
• Working knowledge of common web security vulnerabilities, with some capability in penetration testing, code review, or interface security testing, able to assess risks in application backends, API gateways, authentication, and data flows.
• Proficiency in Python, able to write security detection scripts, log-analysis scripts, and automation/triage tools.
• Good English or Chinese reading, writing, and communication skills, able to collaborate within cross-regional (Europe / APAC) teams; comfortable with global SOC shift work or cross-time-zone collaboration.

Zakres obowiązków:

Position Summary

As a SOC Security Operations Engineer, you will be part of our global security operations function, responsible for monitoring, detecting, investigating, and responding to security threats across the company's IT and business systems. You will help build and continuously improve our detection and response capabilities as part of an aligned, follow-the-sun operating model.

Key Responsibilities

• Own day-to-day security operations (SOC), building and running the mechanisms for risk identification, monitoring, alerting, response, and post-incident review, supporting 7 24 security operations coverage.
• Contribute to the security operations roadmap and standards, driving security risks into a unified operations framework covering log onboarding, detection rules, alert triage, incident response, knowledge management, and operational metrics.
• Perform continuous monitoring and triage of security alerts, with a focus on intrusion attempts, malware, anomalous logins, lateral movement, data exfiltration, and privilege abuse.
• Build and operate detection and response capabilities, including detection rules, attack samples, evaluation use cases, response SOPs, and automated remediation workflows, improving the SOC's ability to detect, analyze, and close out security incidents.
• Conduct pre-production security assessments and operational readiness checks for third-party components, open-source software, and systems going live, delivering risk conclusions, remediation recommendations, and post-launch monitoring requirements.
• Participate in intrusion detection and incident response, performing attack-chain reconstruction, impact analysis, forensics, and root-cause analysis, and driving vulnerability remediation and continuous monitoring.
• Stay current with developments in security offense/defense, threat intelligence, and detection engineering, translating them into operational detection rules, triage logic, and automation capabilities aligned to real SOC scenarios.
• Collaborate with application security, data security, platform engineering, IT, and business teams to drive the detection, classification, response, review, and knowledge capture of security incidents, continuously improving security operations maturity and metrics.