Cybersecurity Incident Response Engineer

• Long-term, stable contract of employment
• Hybrid work from Gdańsk (3 days from the office, 2 remote)

O naszym kliencie

We are recruiting for Acrisure, a global fintech and insurance solutions company that is significantly expanding its presence in Poland through a new operational hub in Gdańsk. Located in Olivia Centre, the Gdańsk office will support Acrisure's growing international operations across key functions including Finance & Accounting, FP&A, Compliance, IT, Cybersecurity and HR. Globally, Acrisure operates across 19 countries, employs around 20,000 people and generates approximately $5 billion in annual revenue. The company promotes a collaborative, entrepreneurial culture built around ownership, innovation and delivering meaningful value to clients.

Opis stanowiska

Key responsibilities

• Investigate incidents involving endpoints, identities, cloud platforms, email, applications, data and networks.
• Perform triage, severity classification, impact analysis, containment, eradication, recovery and root-cause analysis.
• Execute incident response procedures and escalation paths in accordance with the CIRP and regional requirements.
• Analyze EDR, SIEM, MDR, email, cloud and threat-intelligence alerts and distinguish true incidents from false positives.
• Collect and preserve evidence, perform forensic triage, log analysis, malware investigation and timeline reconstruction.
• Conduct proactive threat hunts mapped to MITRE ATT&CK and emerging threat intelligence.
• Maintain complete incident records, timelines, evidence, findings, stakeholder updates and post-incident reports.
• Develop and improve playbooks, detection logic, SOAR workflows and response automations.
• Participate in on-call coverage, tabletop exercises, purple-team activities and major incident response.

Expected outcomes

• Timely, evidence-based incident containment
• High-quality incident records and post-incident reviews
• Improved detection fidelity and playbook coverage
• Reduced recurring incidents through tracked remediation
• Operational participation in on-call and exercises

Operating conditions

• Participation in an on-call or extended-hours response rota may be required, subject to approved policy, contractual arrangements and local employment requirements.
• Occasional travel may be required to support acquired businesses, exercises, investigations or integration work.
• The role handles confidential and potentially sensitive security, employee, client and regulated information.

Profil kandydata

Minimum qualifications

• 5+ years in incident response, security operations, threat hunting or digital forensics.
• Experience with EDR and SIEM technologies and investigations across endpoint, identity, email, cloud and network sources.
• Knowledge of incident response methodology, evidence handling and MITRE ATT&CK.
• Ability to communicate clearly and work under pressure.

Preferred qualifications

• SentinelOne, Defender XDR, Google SecOps, Microsoft Sentinel, ReliaQuest GreyMatter or ServiceNow experience.
• PowerShell, Python or KQL.
• GCIH, GCFA, GCFE, SC-200, CySA+ or equivalent.

Oferujemy

• Permanent employment contract.
• Salary of 26 000 PLN to 30 000 PLN.
• Private healthcare package with Luxmed
• Life insurance with Unum
• MyBenefit cafeteria platform
• Real career growth and learning opportunities within a global organization