Senior Detection & Response Engineer

Aristocrat is a company hiring for a Senior Detection & Response Engineer based in Kraków, Poland, working in the Security Operations team with a hybrid SOC model. The role involves collaboration with internal teams and MSSP partners to enhance security detection and response.

• Experience improving threat detection, security operations, incident response, or related cybersecurity capabilities in production.
• Hands-on Detection Engineering experience.
• Strong ability to create, tune, and maintain detections, searches, analytics, or threat hunting content using security query languages.
• Experience building and maintaining security automations using Tines, SOAR platforms, or similar.
• Experience designing, building, or maintaining automation workflows.
• Experience integrating systems via APIs and automation platforms.
• Solid understanding of threat detection, investigations, and incident response concepts at Tier 3 SOC level.
• Ability to translate operational challenges into scalable detections, automations, and workflow improvements.
• Strong collaboration skills working across Security Operations, Engineering, IT, and MSSP environments.

Detection Engineering:

• Develop, tune, and maintain detections, correlation rules, analytics, searches, and threat detection content across SIEM, EDR, identity, email, SaaS, and security monitoring platforms.
• Identify detection gaps and create new detection use cases.
• Improve detection quality, reduce false positives, and enhance alert fidelity.
• Map detections and use cases to frameworks like MITRE ATT&CK.

Security Automation:

• Design, build, and maintain security automation workflows using Tines and other platforms.
• Build integrations using APIs and workflow automation tools.
• Automate repetitive operational tasks to improve investigation and response.
• Continuously identify automation opportunities to streamline security processes.

Security Operations & Incident Response:

• Support security investigations and response through detection engineering, automation, and analysis.
• Collaborate with threat analysts, MSSP partners, and incident responders.
• Contribute to operational improvements accelerating detection, investigation, and response.
• Assist in measuring and improving detection and workflow effectiveness.

Collaboration & Innovation:

• Partner with Security Operations, Security Engineering, IT, and Product Security teams.
• Evaluate and adopt emerging technologies enhancing analyst efficiency and operations.
• Contribute to continuous evolution of the Security Operations program.

This role follows a hybrid working model and requires onsite attendance at the Kraków office three days per week.