Digital Forensics and Incident Response Specialist (Compromise Assessment & Rapid Response)​ | f/m/d

Our requirements

• fluent in English
• proven experience in the IT security area
• hands-on experience with hardware/software tools used in incident response, computer forensics and network security assessments
• understanding of Windows internals and Active Directory environments
• knowledge of Linux environment and Linux forensic skills
• general understanding of computer networking concepts and protocols
• basic understanding of scripting languages
• strong understanding of the Cyber Kill Chain, MITRE ATT&CK Framework, and modern threat actor TTPs
• basic understanding of MS Defender EDR and MS Sentinel environments to use KQL queries for threat hunting purposes
• ability to stay focused, keep calm and work under high stress
• ability to communicate with technical and business stakeholders
• ability to work in a multinational and multicultural environment
• strong teamwork culture with effective collaboration, cross-group partnership
• being an innovator, creative, passionate, independent, and motivated to make a difference and help reduce cyber risk for ERGO Group

Optional

• Bachelor / Master in IT / Business IT / Computer Science or similar education
• Certified: Security+, CySA+, CEH or equivalent

Your responsibilities

• scanning management for a Compromise Assessment and Rapid Response (CA&RR) tool for various customers in the ERGO group
• preparing analysis of findings in the CA&RR tools (e.g. detecting backdoors, attackers' tools, system misconfigurations, forensics artifacts or other malicious activity)
• developing of rapid response playbooks
• analyzing of malware files
• creating of custom YARA and Sigma rules
• performing threat hunting iterations based on feed delivered from CTI Team and researching on recent campaigns using EDR, APT Scanner, SIEM and other security tools
• defining of threat remediation strategies for various customers in the ERGO group
• developing and refining of hypothesis and queries to detect threats
• providing detailed reports on threat hunting iterations against known hacker groups
• cooperating with technical teams as the SOC, CTI and CSIRT

About the role

What we offer

• Let's be healthy – medical package, sports card, and numerous sports sections – these are some of the benefits that help our employees stay in good shape.
• Let's be balanced – work-life balance is a key aspect of a healthy workplace. We offer our employees flexible working hours, a confidential employee assistant program, as well as the possibility of remote working. However, staying at home with our in-office gaming room and dog-friendly office in Warsaw won’t be easy.
• Let's be smart – we organize numerous workshops and training courses. Thanks to hackathons and meetups, our specialists share their expertise with others. Additionally, we have a wide range of digital learning platforms and language courses.
• Let's be responsible – each year, we participate in several CSR activities, during which, together with our colleagues, we do our best to create a better future.
• Let's be fun – company-wide bike races and soccer matches, film marathons in our cinema room or other engaging team-building activities – we got it covered!
• Let's be diverse – every team member is valued, regardless of gender, nationality, religious beliefs, disability, age, and sexual orientation or identity. Your qualifications, experience, and mindset are our greatest benefit!

Benefits

• sharing the costs of sports activities
• private medical care
• sharing the costs of foreign language classes
• sharing the costs of professional training & courses
• life insurance
• remote work opportunities
• integration events
• employee referral program
• charity initiatives

ERGO Technology & Services S.A.