Текст заказа
Detect, investigate, contain, eradicate and support recovery from cyber incidents across Acrisure International, while improving threat detection, response playbooks and forensic readiness.
Client Details
We are recruiting for Acrisure, a global fintech and insurance solutions company that is significantly expanding its presence in Poland through a new operational hub in Gdańsk. Located in Olivia Centre, the Gdańsk office will support Acrisure's growing international operations across key functions including Finance & Accounting, FP&A, Compliance, IT, Cybersecurity and HR. Globally, Acrisure operates across 19 countries, employs around 20,000 people and generates approximately $5 billion in annual revenue. The company promotes a collaborative, entrepreneurial culture built around ownership, innovation and delivering meaningful value to clients.
Description
Key responsibilities
· Investigate incidents involving endpoints, identities, cloud platforms, email, applications, data and networks.
· Perform triage, severity classification, impact analysis, containment, eradication, recovery and root-cause analysis.
· Execute incident response procedures and escalation paths in accordance with the CIRP and regional requirements.
· Analyze EDR, SIEM, MDR, email, cloud and threat-intelligence alerts and distinguish true incidents from false positives.
· Collect and preserve evidence, perform forensic triage, log analysis, malware investigation and timeline reconstruction.
· Conduct proactive threat hunts mapped to MITRE ATT&CK and emerging threat intelligence.
· Maintain complete incident records, timelines, evidence, findings, stakeholder updates and post-incident reports.
· Develop and improve playbooks, detection logic, SOAR workflows and response automations.
· Participate in on-call coverage, tabletop exercises, purple-team activities and major incident response.
Expected outcomes
· Timely, evidence-based incident containment
· High-quality incident records and post-incident reviews
· Improved detection fidelity and playbook coverage
· Reduced recurring incidents through tracked remediation
· Operational participation in on-call and exercises
Operating conditions
· Participation in an on-call or extended-hours response rota may be required, subject to approved policy, contractual arrangements and local employment requirements.
· Occasional travel may be required to support acquired businesses, exercises, investigations or integration work.
· The role handles confidential and potentially sensitive security, employee, client and regulated information.
Profile
Minimum qualifications
· 5+ years in incident response, security operations, threat hunting or digital forensics.
· Experience with EDR and SIEM technologies and investigations across endpoint, identity, email, cloud and network sources.
· Knowledge of incident response methodology, evidence handling and MITRE ATT&CK.
· Ability to communicate clearly and work under pressure.
Preferred qualifications
· SentinelOne, Defender XDR, Google SecOps, Microsoft Sentinel, ReliaQuest GreyMatter or ServiceNow experience.
· PowerShell, Python or KQL.
· GCIH, GCFA, GCFE, SC-200, CySA+ or equivalent.
Job Offer
* Permanent employment contract.
* Salary of 26 000 PLN to 30 000 PLN.
* Private healthcare package with Luxmed
* Life insurance with Unum
* MyBenefit cafeteria platform
* Real career growth and learning opportunities within a global organization