Key duties:
- SIEM/SOC - you maintain SIEM as the core of the internal SOC and the SOC services provided to clients: you connect and normalize log sources, create your own detection and correlation rules, and tune automatic responses (Active Response).
- Detection and incident response - you handle alerts from agent-based XDR host monitoring, analyze anomalies and conduct incident response per IR procedures (event/incident/failure classification, CIA analysis, intervention actions).
- Vulnerability management - you run periodic scans with an authorized scanner, triage results (CVE/CVSS/KEV) and coordinate remediation with technical teams and report their status.
- Identity, access and secrets - you maintain MFA/2FA and VPN, develop privileged account management (PAM) in a least-privilege model and maintain a password vault: policies, service password rotation, roles and access audit.
- Server and container security - you administer Linux servers and harden them per CIS guidelines, secure SSH access (keys, protection against dictionary attacks), automate repetitive tasks (e.g., CRON/Bash/Python) and secure container environments (Docker, LXC/LXD).
- Backups - you design and maintain backups of critical systems and their configurations in a 3-2-1 model, schedule and monitor jobs, run periodic restore tests, protect backups from ransomware effects and manage their encryption and retention per continuity policies.
- Network - you ensure network segmentation (e.g., OT, backup/DC, corporate and medical networks, VoIP/PBX, mgmt) and iptables/nftables rules, and support device monitoring via SNMP.
- Cryptographic posture - you manage the TLS/SSL certificate lifecycle and internal PKI/CA, enforce secure protocols and cipher suites on services (web, mail, VPN, SSH), oversee key management (rotation, secure storage, access control) and encryption at rest and in transit, and detect and eliminate weak cryptography.
- Mail - you secure the mail system: anti-spam, enforcing password policies and tuning.
- Security awareness - you build and run campaigns and phishing simulations (custom scenarios, test environment, data minimization), analyze effectiveness and train employees.
- Compliance and documentation - you co-develop security policies and procedures and ISMS documentation (playbooks, registers, reports) in line with NIS2/uKSC and ISO 27001
Requirements:
- Minimum 2 years of experience in the field of IT cybersecurity.
- Very good knowledge of Linux systems: administration, hardening according to CIS guidelines, secure SSH configuration and automation.
- Practical implementation and maintenance of SIEM and agent-based XDR - from onboarding and log normalization, through detection rules and correlation, to dashboards and incident response procedures.
- Experience in vulnerability management: scanning with an authorized scanner, triage of results, knowledge of CVE/CVSS/KEV and coordination of remediation.
- Knowledge of networking topics needed for security and segmentation: TCP/IP, VLAN, network segmentation, routing, VPN, iptables/nftables and SNMP.
- Management of cryptographic posture, TLS/SSL certificates and PKI (lifecycle, renewal, revocation), hardening of protocols and cipher suites, key management and encryption of data at rest and in transit.
- Experience in identity and access management: MFA/2FA, privileged accounts (PAM) in a least-privilege model and password/secret management (password vaults, rotation, policies, audit).
- Maintaining backup systems: 3-2-1 strategy, scheduling and monitoring jobs, recovery testing (RPO/RTO) and protection of backups against ransomware (immutable/offline backups).
- Knowledge of containerization in the context of security (Docker, LXC/LXD).
- Practical knowledge of NIS2/uKSC and ISO 27001 requirements and the ability to document thoroughly (IR procedures, playbooks, ISMS, registers).
- Experience running phishing campaigns and simulations and conducting security trainings.
- Willingness to respond to critical incidents outside standard hours (sporadically, under terms agreed within the CSIRT team).
We offer:
- Attractive remuneration
- Stable employment in a company with an established market position.
- Flexible forms of employment and hybrid work.
- Advanced technology stack in the area of security.
- Short decision-making path and a partnership approach - you have a real voice in the choice of tools and security direction.
- Support from an experienced team of administrators and close cooperation within the CSIRT team and people responsible for compliance.
- Room for skills development and certifications.
- Gaining experience in a regulated, demanding healthcare sector.
- Unlimited access to coffee, friendly atmosphere and a modern office, and most importantly - no parking problems
Nice to have:
- Knowledge of Microsoft service security topics, in particular Active Directory/LDAPS.
- Knowledge of network monitoring / NDR, including traffic collection architecture (SPAN/TAP) and anomaly analytics.
- Experience with OT industrial protocols
