Security Engineer

About the Project

You’ll build and lead a SOC team from scratch for a global SaaS company (unicorn-stage, 20+ offices, Fortune 500 clients). The customer Security team is super strong and the stack is superior. As the first SOC leader (in charge of 6 Tier 2 analysts), you’ll upgrade existing response processes so the internal team can focus on security engineering.

You’re the escalation point for your analysts and the client’s IT, DevOps, and App Security teams, and you own 24/7 coverage, SOC KPIs, and the feedback loop to Security Engineering. This is not a ticket-closing role: you set the tone for how incidents are handled.

What You’ll Do

• Lead the team: run the L2 analysts day-to-day (prioritization, playbooks, escalations), hold team syncs and handovers, and mentor and onboard analysts
• Own 24/7 coverage: build and maintain shift schedules and on-call rotations so the SOC is always staffed
• Own incident response: lead the full lifecycle from triage to closure, coordinate high-severity events and run post-incident reviews
• Investigate hands-on: be the escalation point and work complex alerts alongside analysts, beyond Tier 2 capability
• Measure and report: track team and individual performance and out comes against KPIs and SLAs (MTTA, MTTR, SLA compliance, false positive rate, backlog) and report to management and the client
• Bridge to Security Engineering: turn analyst pain points (false positives, alert fatigue, detection gaps) into detection tuning and improvement suggestions.
• Communicate clearly: work with the client’s security team at technical and managerial level, with honest status updates, including when something is unknown

What You Bring

Hard requirements (non-negotiable):

• 5+ years in SOC / incident response roles, including prior Tier 2/3 analyst experience. Not just monitoring: actual IR ownership
• 2+ years of team lead or management experience in a SOC, including shift lead or mentoring responsibility
• Proven experience building and running 24/7 shift schedules and on-call rotations, and keeping coverage intact in practice
• Proven experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance): you can show how you measured a team and improved it
• Experience leading or coordinating a team during an active incident, and the ability to describe it step by step
• Cloud / AWS security experience: ability to investigate and respond to cloud alerts on day one
• SaaS investigation experience
• SIEM hands-on: Splunk (required), with the ability to write and read SPL queries. CrowdStrike SIEM is a strong plus
• EDR: Microsoft Defender and/or CrowdStrike
• Working knowledge of both Windows and macOS environments
• Strong communication skills, bridging SOC operations and Security Engineering. Intellectual honesty: you say “I don’t know” when you don’t know

Strong plus:

• Identity platforms: Okta, Azure AD
• SOAR automation and threat hunting
• Experience building a SOC at level 4-5 based on SOC-CMM
• Feeding analyst findings into detection engineering (tuning, new detections)

Things that won’t work here

• Only closing alerts without owning the IR process
• Never having owned a shift schedule, on-call rota or KPI reporting
• Managing from the sidelines instead of investigating alongside the team
• Confident wrong answers instead of acknowledged gaps
• No ability to describe team coordination during a real incident

Tech Stack

Splunk · Microsoft Defender · CrowdStrike · Okta · AWS

What We Offer

• Superior technical team and a great customer with massive modern infrastructure
• AI everywhere, with the ability to automate every step: work smarter, not harder
• Real ownership from day one to build the SOC processes, coverage model and KPIs
• Direct collaboration with the client’s senior security team
• Warsaw office (day shifts), with a flexible on-call and night coverage model you design with your team
• Relocation support