Senior Incident Response Analyst | ErnstYoung Job

Your scope of duties

• Independently leading the technical response to high-severity and critical cybersecurity incidents.
• Confirming the scope of an attack, level of compromise, attack vector, business impact and required response actions.
• Performing advanced analysis of endpoint, network, identity, application and cloud telemetry.
• Reconstructing attack paths and preparing detailed incident timelines.
• Conducting threat hunting based on indicators of compromise, attacker behaviours, tactics, techniques and procedures.
• Designing, recommending and overseeing containment and eradication activities.
• Analysing malware, scripts, processes, persistence mechanisms, lateral movement and privilege escalation.
• Performing root cause analysis and defining measures to prevent incident recurrence.
• Assessing the risks associated with restoring systems and services.
• Supporting decisions related to network segmentation, account and credential resets, system rebuilds, backup restoration and service recovery.
• Acting as the technical lead during major cybersecurity incidents.
• Mentoring Junior Incident Response Analysts.
• Developing, testing and improving incident response playbooks.
• Preparing the technical sections of post-incident reports and participating in post-incident reviews.

Our requirements

• Several years of professional experience in Incident Response, Security Operations Centre operations, Digital Forensics and Incident Response, threat hunting or cyber defence.
• Broad knowledge of network, endpoint, operating system, application, identity and data security.
• Advanced knowledge of incident investigation methodologies and the MITRE ATT&CK framework.
• Strong experience with SIEM, EDR/XDR, NDR, SOAR, detection and forensic tools.
• Strong knowledge of Windows, Linux, Active Directory, Microsoft Entra ID and network protocols.
• Experience in investigating phishing, ransomware, account compromise, application attacks and data exfiltration.
• Hands-on experience with at least one major cloud platform, such as AWS, Microsoft Azure or Google Cloud.
• Experience in digital forensics, memory analysis, timeline analysis and evidence preservation.
• Experience in recovery activities, including secure service restoration, system rebuilds, backup validation and post-recovery monitoring.
• Strong communication skills and the ability to work effectively under pressure.

What we offer

• Participation in projects addressing complex cybersecurity incidents across diverse technology environments.
• Access to advanced security technologies and opportunities to further develop expertise in Incident Response, threat hunting and digital forensics.
• A role with a real impact on the development of incident response playbooks, investigation standards and the broader Incident Response capability.
• Professional and financial support in obtaining recognised qualifications and certificates.
• EY Badges – global certification of your competencies and the opportunity to earn an MBA title from the prestigious Hult International School of Business.
• Career Counselor – professional, one-to-one guidance on career building and development.
• Psycho-educational platform – a package of free consultations with specialists in the broad field of mental health and personal development and access to educational activities.
• Benefit programme offering private healthcare with additional preventive examinations, life insurance, tickets, team sports, a language learning platform, sports cards and much more, available online and offline.

Recruitment stages

1. Apply. If this is your first time applying, create a profile and upload your CV.
2. Let’s talk. You will meet our Talent Acquisition experts and members of your future team.

About EY Poland