Security Engineer
Warsaw, Poland (on-site) | Full-time | Relocation support available
About the Project:
You’ll build and lead a SOC team from scratch for a global SaaS company (unicorn-stage, 20+
offices, Fortune 500 clients). The customer Security team is super strong and the stack is
superior. As the first SOC leader (in charge of 6 Tier 2 analysts), you’ll upgrade existing
response processes so the internal team can focus on security engineering.
You’re the escalation point for your analysts and the client’s IT, DevOps, and App Security
teams, and you own 24/7 coverage, SOC KPIs, and the feedback loop to Security Engineering.
This is not a ticket-closing role: you set the tone for how incidents are handled.
What You’ll Do:
- Lead the team: run the L2 analysts day-to-day (prioritization, playbooks,
escalations), hold team syncs and handovers, and mentor and onboard analysts - Own 24/7 coverage: build and maintain shift schedules and on-call rotations so the
SOC is always staffed - Own incident response: lead the full lifecycle from triage to closure, coordinate
high-severity events and run post-incident reviews - Investigate hands-on: be the escalation point and work complex alerts alongside
analysts, beyond Tier 2 capability - Measure and report: track team and individual performance and out comes against
KPIs and SLAs (MTTA, MTTR, SLA compliance, false positive rate, backlog) and
report to management and the client - Bridge to Security Engineering: turn analyst pain points (false positives, alert
fatigue, detection gaps) into detection tuning and improvement suggestions. - Communicate clearly: work with the client’s security team at technical and
managerial level, with honest status updates, including when something is unknown
What You Bring:
Hard requirements (non-negotiable):
- 5+ years in SOC / incident response roles, including prior Tier 2/3 analyst
experience. Not just monitoring: actual IR ownership - 2+ years of team lead or management experience in a SOC, including shift lead
or mentoring responsibility - Proven experience building and running 24/7 shift schedules and on-call
rotations, and keeping coverage intact in practice - Proven experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance):
you can show how you measured a team and improved it - Experience leading or coordinating a team during an active incident, and the ability to
describe it step by step - Cloud / AWS security experience: ability to investigate and respond to cloud alerts
on day one - SaaS investigation experience
- SIEM hands-on: Splunk (required), with the ability to write and read SPL queries.
CrowdStrike SIEM is a strong plus - EDR: Microsoft Defender and/or CrowdStrike
- Working knowledge of both Windows and macOS environments
- Strong communication skills, bridging SOC operations and Security Engineering.
Intellectual honesty: you say “I don’t know” when you don’t know
Strong plus:
- Identity platforms: Okta, Azure AD
- SOAR automation and threat hunting
- Experience building a SOC at level 4-5 based on SOC-CMM
- Feeding analyst findings into detection engineering (tuning, new detections).
Red Flags (things that won’t work here)
- Only closing alerts without owning the IR process
- Never having owned a shift schedule, on-call rota or KPI reporting
- Managing from the sidelines instead of investigating alongside the team
- Confident wrong answers instead of acknowledged gaps
- No ability to describe team coordination during a real incident
Tech Stack:
Splunk · Microsoft Defender · CrowdStrike · Okta · AWS
What We Offer:
- Superior technical team and a great customer with massive modern infrastructure
- AI everywhere, with the ability to automate every step: work smarter, not harder
- Real ownership from day one to build the SOC processes, coverage model and KPIs
- Direct collaboration with the client’s senior security team
- Warsaw office (day shifts), with a flexible on-call and night coverage model you
design with your team - Relocation support