Cybersecurity Incident Response Engineer

Key responsibilities· Investigate incidents involving endpoints, identities, cloud platforms, email, applications, data and networks.
· Perform triage, severity classification, impact analysis, containment, eradication, recovery and root-cause analysis.
· Execute incident response procedures and escalation paths in accordance with the CIRP and regional requirements.
· Analyze EDR, SIEM, MDR, email, cloud and threat-intelligence alerts and distinguish true incidents from false positives.
· Collect and preserve evidence, perform forensic triage, log analysis, malware investigation and timeline reconstruction.
· Conduct proactive threat hunts mapped to MITRE ATT&CK and emerging threat intelligence.
· Maintain complete incident records, timelines, evidence, findings, stakeholder updates and post-incident reports.
· Develop and improve playbooks, detection logic, SOAR workflows and response automations.
· Participate in on-call coverage, tabletop exercises, purple-team activities and major incident response.
Expected outcomes· Timely, evidence-based incident containment
· High-quality incident records and post-incident reviews
· Improved detection fidelity and playbook coverage
· Reduced recurring incidents through tracked remediation
· Operational participation in on-call and exercises
Operating conditions· Participation in an on-call or extended-hours response rota may be required, subject to approved policy, contractual arrangements and local employment requirements.
· Occasional travel may be required to support acquired businesses, exercises, investigations or integration work.
· The role handles confidential and potentially sensitive security, employee, client and regulated information.

Minimum qualifications· 5+ years in incident response, security operations, threat hunting or digital forensics.
· Experience with EDR and SIEM technologies and investigations across endpoint, identity, email, cloud and network sources.
· Knowledge of incident response methodology, evidence handling and MITRE ATT&CK.
· Ability to communicate clearly and work under pressure.
Preferred qualifications· SentinelOne, Defender XDR, Google SecOps, Microsoft Sentinel, ReliaQuest GreyMatter or ServiceNow experience.
· PowerShell, Python or KQL.
· GCIH, GCFA, GCFE, SC-200, CySA+ or equivalent.

• Permanent employment contract.
• Salary of 26 000 PLN to 30 000 PLN.
• Private healthcare package with Luxmed
• Life insurance with Unum
• MyBenefit cafeteria platform
• Real career growth and learning opportunities within a global organization