Head of Threat Hunting / CARR | f/m/d

Our requirements

• fluent English
• academic degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a comparable field; or equivalent professional qualifications and extensive experience in IT and/or information security
• relevant professional certifications such as GIAC Certified Incident Analyst (GCIA), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Intrusion Hunter (GCIH), GIAC Network Forensic Analyst (GNFA), Offensive Security Certified Professional (OSCP), Certified Information Systems Security Professional (CISSP), or Certified Information Security Manager (CISM) are highly desirable
• minimum of 7 years in cybersecurity or information security roles, with at least 3 years in a leadership or managerial capacity within threat hunting, incident response, or SOC/CSIRT environments
• proven track record of handling and coordinating complex cybersecurity incidents such as advanced persistent threats (APTs), ransomware attacks, data breaches, and insider threats in large-scale enterprise settings
• extensive experience working in corporate group structures and global matrix organizations, managing cross-functional teams and complex IT environments
• deep understanding of attacker tactics, techniques, and procedures (TTPs) as outlined in frameworks like MITRE ATT&CK, including threat actor behavior and intrusion patterns
• strong knowledge of network and endpoint security, operating systems (Windows, Linux), identity and access management, cloud security platforms, and modern security monitoring architectures
• hands-on experience with digital forensics, malware analysis, log analysis, SIEM, Endpoint Detection & Response (EDR/XDR), Security Orchestration, Automation and Response (SOAR), and other detection and response tooling
• ability to rapidly assess complex technical incidents and lead appropriate containment, eradication, and remediation actions
• methodological and personal competencies: excellent analytical and conceptual skills with the ability to communicate complex technical information clearly and effectively to diverse audiences, from technical teams to senior management
• strong leadership, team building, and stakeholder management abilities, with a collaborative approach to working in globally distributed environments
• strategic mindset with a focus on continuous improvement, innovation, and maintaining operational excellence

Your responsibilities

• leading, mentoring, and developing a high-performing global team of threat hunting professionals
• designing and implementing proactive threat hunting methodologies to identify and mitigate advanced cyber threats
• collaborating with incident response, security operations, and intelligence teams to improve overall security posture
• analyzing emerging threat trends, develop actionable intelligence, and communicate findings to stakeholders
• establishing and maintaining threat hunting frameworks, tools, and best practices
• ensuring alignment of threat hunting activities with organizational security policies and business objectives
• managing and prioritizing team workload, ensuring timely detection and response to threats
• driving continuous improvement initiatives and innovation within the threat hunting program
• coordinating with global security teams to ensure 8x5 threat hunting coverage and incident escalation
• supporting major cyber incidents with reactive threat hunting activities
• consolidating and interpreting technical results and data for Head of CSIRT APAC and other stakeholders to support timely and well‑founded decision‑making
• preparing clear, audience‑appropriate communication and reporting on threat findings for different stakeholder groups, including senior management, risk/compliance functions and technical teams
• driving the ongoing development and optimization of Threat Hunting processes, guidelines, procedures, metrics, and documentation
• driving the evolution of the Threat Hunting team technical capabilities (e.g. SIEM, EDR/XDR, SOAR, EDR and Thor APT), including evaluation, design and implementation of new solutions
• supporting the regional CSIRT Heads with reporting duties, audits, management briefings and the definition and tracking of incident response KPIs and KRIs
• delivering against all contractual obligations for the existing CA&RR Service established for ERGO´s international affiliates
• performing other tasks entrusted by superiors, within the scope of the position and possessed competences

About the role

What we offer

• Let's be healthy – medical package, sports card, and numerous sports sections – these are some of the benefits that help our employees stay in good shape.
• Let's be balanced – work-life balance is a key aspect of a healthy workplace. We offer our employees flexible working hours, a confidential employee assistant program, as well as the possibility of remote working. However, staying at home with our in-office gaming room and dog-friendly office in Warsaw won’t be easy.
• Let's be smart – we organize numerous workshops and training courses. Thanks to hackathons and meetups, our specialists share their expertise with others. Additionally, we have a wide range of digital learning platforms and language courses.
• Let's be responsible – each year, we participate in several CSR activities, during which, together with our colleagues, we do our best to create a better future.
• Let's be fun – company-wide bike races and soccer matches, film marathons in our cinema room or other engaging team-building activities – we got it covered!
• Let's be diverse – every team member is valued, regardless of gender, nationality, religious beliefs, disability, age, and sexual orientation or identity. Your qualifications, experience, and mindset are our greatest benefit!

Benefits

• sharing the costs of sports activities
• private medical care
• sharing the costs of foreign language classes
• sharing the costs of professional training & courses
• life insurance
• remote work opportunities
• integration events
• employee referral program
• charity initiatives

ERGO Technology & Services S.A.