Senior Security Operations Engineer

• Typically 5+ years of experience in security operations, detection engineering, or incident response, with hands-on experience building solutions.
• Experience building detections and investigating incidents in AWS, using sources such as CloudTrail, GuardDuty, VPC Flow Logs, and Kubernetes audit logs.
• Comfortable leading at least one of the following areas, ideally several:
  • Detection engineering and detection-as-code.
  • Incident response and cloud forensics.
  • SIEM and security data pipeline architecture.
  • Security automation (SOAR) and alert triage workflows.
  • Threat hunting and threat intelligence.
• Able to write code in Python, SQL, or a SIEM query language, treat detections and runbooks like software, and automate repetitive work.
• Able to run incidents, keep stakeholders informed, and communicate technical findings as impact and next steps to engineers, leadership, non-technical colleagues, and, when needed, customers.

Nice to Have:

• Experience building incident response and logging controls for SOC 2, ISO 27001, or PCI audits.
• Experience managing an MDR or MSSP partner.
• Familiarity with breach notification obligations, such as UAE PDPL and customer contractual SLAs.
• Experience hiring or mentoring security analysts or engineers as a function grows.

• Build and operate security operations across cloud, identity, endpoint, and SaaS, covering threat detection, threat hunting, and incident response.
• Design and build security data pipelines that bring logs from cloud, identity, endpoint, and SaaS sources into a SIEM or security data lake; normalize and enrich data at ingestion, monitor pipeline health, and balance coverage against cost and retention requirements.
• Select, deploy, configure, and tune SIEM, EDR, cloud threat detection, and automation tooling to improve alert signal-to-noise ratio.
• Write detections as code, map them to MITRE ATT&CK, measure and test coverage, and focus effort where risk is highest.
• Own the incident response plan and playbooks; act as incident commander for security events and coordinate containment and recovery across engineering, legal, and leadership.
• Run blameless post-incident reviews.

• The role is remote and based in Poland.