05/16/2026 updated
100 % available
Cybersecurity Analyst | SOC & Incident Response | SOAR & Threat Detection
Gdańsk, Poland
Only remote
M.Sc. Automation, Cybernetics & RoboticsServiceNow Security OperationsIncident ResponseIntelligence AnalysisLog AnalysisArcSight SIEM ToolCyber Threat AnalysisAzure Security CenterSplunkStream Analytics
SIEM & Log Management
Expertise in SIEM platforms including Splunk, Microsoft Sentinel, Wazuh, Elastic, and KQL for real-time monitoring, log analysis, and threat detection across enterprise environments.
Incident Detection & Response
End-to-end incident response capabilities covering root cause analysis, threat containment, mitigation strategy implementation, and audit-ready reporting aligned with NIST CSF and MITRE ATT&CK frameworks.
SOAR & Automation
Engineering of SOAR automation workflows using n8n, Tines, Shuffle, and Microsoft Logic Apps to streamline alert triage, automate repetitive security tasks, and reduce mean time to respond (MTTR).
Endpoint Security (EDR/XDR)
Deployment and management of EDR/XDR capabilities via Microsoft Defender for Endpoint, including endpoint alert investigation and threat containment across Windows and Linux environments.
Vulnerability Assessment
Conducting vulnerability assessments using Nessus, prioritizing CVEs, and coordinating remediation with infrastructure teams to reduce organizational attack surfaces.
Cloud Security (Azure/AWS)
Applied knowledge of cloud security principles and operations within Microsoft Azure and AWS environments, including identity and access management.
DFIR & Security Tools
Proficiency with DFIR tools including IRIS-DFIR, Wireshark, Kali Linux, Metasploit, Nmap, and Hydra for forensic investigation and attack simulation.
Identity & Access Management
Management of user accounts, permissions, and access controls via Active Directory and IAM tools, enforcing least-privilege access and lifecycle management policies.
Python & Bash Scripting
Scripting capabilities in Python and Bash for automation, API integration, and security operations support tasks.
Governance & Risk
Vulnerability management, risk assessment, compliance documentation, and audit readiness aligned with NIST CSF frameworks.
Phishing Simulation & Security Awareness Training
Design and delivery of cybersecurity awareness training programs and phishing simulation exercises to measurably reduce user-related security risk.
Expertise in SIEM platforms including Splunk, Microsoft Sentinel, Wazuh, Elastic, and KQL for real-time monitoring, log analysis, and threat detection across enterprise environments.
Incident Detection & Response
End-to-end incident response capabilities covering root cause analysis, threat containment, mitigation strategy implementation, and audit-ready reporting aligned with NIST CSF and MITRE ATT&CK frameworks.
SOAR & Automation
Engineering of SOAR automation workflows using n8n, Tines, Shuffle, and Microsoft Logic Apps to streamline alert triage, automate repetitive security tasks, and reduce mean time to respond (MTTR).
Endpoint Security (EDR/XDR)
Deployment and management of EDR/XDR capabilities via Microsoft Defender for Endpoint, including endpoint alert investigation and threat containment across Windows and Linux environments.
Vulnerability Assessment
Conducting vulnerability assessments using Nessus, prioritizing CVEs, and coordinating remediation with infrastructure teams to reduce organizational attack surfaces.
Cloud Security (Azure/AWS)
Applied knowledge of cloud security principles and operations within Microsoft Azure and AWS environments, including identity and access management.
DFIR & Security Tools
Proficiency with DFIR tools including IRIS-DFIR, Wireshark, Kali Linux, Metasploit, Nmap, and Hydra for forensic investigation and attack simulation.
Identity & Access Management
Management of user accounts, permissions, and access controls via Active Directory and IAM tools, enforcing least-privilege access and lifecycle management policies.
Python & Bash Scripting
Scripting capabilities in Python and Bash for automation, API integration, and security operations support tasks.
Governance & Risk
Vulnerability management, risk assessment, compliance documentation, and audit readiness aligned with NIST CSF frameworks.
Phishing Simulation & Security Awareness Training
Design and delivery of cybersecurity awareness training programs and phishing simulation exercises to measurably reduce user-related security risk.
Experience
Professional experience0 - 5 years
Freelancer since2021
Languages
GermanFluentEnglishFluentPolishBasic knowledgeCroatianFluent
Project history
Monitoring and analyzing network traffic, SIEM alerts (Splunk, Wazuh, Microsoft Sentinel, KQL), and security logs to detect, investigate, and respond to threats in real time. Conducting vulnerability assessments using Nessus, leading end-to-end incident response, engineering SOAR automation workflows, deploying EDR/XDR capabilities, and delivering cybersecurity awareness training and phishing simulations. Technologies: Splunk, KQL, Wazuh, Microsoft Sentinel, SIEM, IDS/IPS, Nessus, SOAR, n8n, Tines, Shuffle, Logic Apps, Microsoft Defender, EDR, XDR, IRIS-DFIR, Compliance, Incident Response.
Designed and deployed a full virtual SOC environment using VirtualBox (Ubuntu 22.04, Windows 10, Kali Linux) to simulate enterprise threat detection and incident response workflows. Installed and configured Wazuh SIEM, integrated IRIS Incident Response Platform via REST API, and executed attack simulations with Kali Linux tools including Nmap, Hydra, and Metasploit. Technologies: VirtualBox, Wazuh SIEM, IRIS IR Platform, Windows 10, Kali Linux, Ubuntu 22.04 LTS.
Engineered a SOAR automation pipeline integrating Wazuh with n8n for real-time ingestion and processing of security alerts via webhook. Configured Wazuh to forward alerts via custom ossec.conf integration, built n8n workflow to extract alert metadata and query VirusTotal API for IP reputation analysis. Implemented automated conditional response with Slack and email notifications. Technologies: n8n, Wazuh, VirusTotal API, Slack, Email.