Lead Security Operations Engineer

Gainsight is an AI-powered customer success platform trusted by over 2,000 companies, providing solutions for customer journey orchestration from onboarding to advocacy. The company focuses on AI-driven customer retention and growth.

• 6+ years experience in security operations with responsibility across triage, incident response, and detection engineering
• Proven leadership or mentoring experience providing technical guidance and coaching
• Deep expertise with SIEM, EDR, and SOAR platforms including rule-writing and automation
• Strong incident response leadership with management of complex incidents end-to-end
• Solid knowledge of cloud security architecture in AWS, Azure, or GCP environments
• Experience working with DevOps and Engineering to embed security into CI/CD pipelines and infrastructure
• Proficiency in scripting or automation such as Python or PowerShell to build response workflows
• Familiarity with attacker tactics and techniques (MITRE ATT&CK) and translating them into detection logic
• Excellent communication skills for briefing executives and technical teams during incidents

Nice to have:

• Hands-on experience with cloud-native detection and posture tools like AWS GuardDuty, Azure Sentinel, Wiz, Prisma Cloud
• Familiarity with container and orchestration security technologies like Docker and Kubernetes
• Experience with threat intelligence platforms and proactive threat hunting frameworks like MITRE ATT&CK or Sigma rules
• Exposure to purple team or adversary simulation exercises such as Atomic Red Team or Caldera
• Relevant certifications such as GCIH, GCFA, GCTI, CISSP, OSCP
• Knowledge of network security architecture including segmentation, zero trust, and cloud network security groups
• Experience with vulnerability management programs and data loss prevention tools

• Own complex or high-severity incidents end-to-end, from triage to containment, remediation, and post-incident review, keeping stakeholders informed
• Lead incident response for significant security events including host, network, and memory forensics
• Develop and implement detection strategies across SIEM, EDR, and SOAR platforms
• Collaborate with DevOps and Engineering to embed security controls into infrastructure and CI/CD pipelines
• Coach and mentor analysts and engineers to enhance team independence and technical expertise
• Translate complex technical findings into clear reports for technical and non-technical stakeholders
• Assess, select, and integrate security tools to improve coverage without adding unnecessary complexity or cost

• This role is hybrid based in Wrocław, Poland
• Requires occasional travel up to 10-20% for team meetings, training, or company events
• Applications must be submitted in English
• Equal opportunity employer committed to inclusive and transparent hiring
• Data administrator: Gainsight (Northpass Poland Sp. z o.o.) located in Wrocław
• Applicant data processed according to Polish labor law and GDPR regulations