Head of Threat Hunting / CARR | f/m/d

About UsERGO Technology & Services S.A. (ET&S), a member of the Munich Re and ERGO Group, is delivering integrated IT and business services to international markets. Our expertise lies in providing advanced IT services, with a focus on modern, business-driven technology solutions. On the business side, we also support the Group in various end-to-end insurance processes, including finance, operations, and underwriting. With offices in Warsaw and Gdansk, and strong global partnerships, we foster a dynamic, multicultural environment that promotes diversity and international opportunities.About the roleThe Head of the Global Threat Hunting Team plays a critical role in safeguarding our organization against sophisticated digital cyber threats by leading a specialized team dedicated to proactive threat hunting and mitigation. This position exists to ensure the early identification of emerging and advanced threats before they can impact business operations, thereby reduce risk and protect our valuable digital assets worldwide.The purpose of this role is to establish and drive a world-class threat hunting function that continuously enhances our defensive capabilities by leveraging cutting-edge techniques, threat intelligence, and cross-functional collaboration. The manager will cultivate a culture of vigilance, innovation, and operational excellence within the team, aligning threat hunting efforts with the broader security strategy and organizational goals.By championing proactive threat discovery and mitigation, this role directly contributes to maintaining business continuity, safeguarding customer trust, and fortifying our position as a leader in cybersecurity resilience on a global scale.How you will get the job doneleading, mentoring, and developing a high-performing global team of threat hunting professionalsdesigning and implementing proactive threat hunting methodologies to identify and mitigate advanced cyber threatscollaborating with incident response, security operations, and intelligence teams to improve overall security postureanalyzing emerging threat trends, develop actionable intelligence, and communicate findings to stakeholdersestablishing and maintaining threat hunting frameworks, tools, and best practicesensuring alignment of threat hunting activities with organizational security policies and business objectivesmanaging and prioritizing team workload, ensuring timely detection and response to threatsdriving continuous improvement initiatives and innovation within the threat hunting programcoordinating with global security teams to ensure 8x5 threat hunting coverage and incident escalationsupporting major cyber incidents with reactive threat hunting activitiesconsolidating and interpreting technical results and data for Head of CSIRT APAC and other stakeholders to support timely and well‑founded decision‑makingpreparing clear, audience‑appropriate communication and reporting on threat findings for different stakeholder groups, including senior management, risk/compliance functions and technical teamsdriving the ongoing development and optimization of Threat Hunting processes, guidelines, procedures, metrics, and documentationdriving the evolution of the Threat Hunting team technical capabilities (e.g. SIEM, EDR/XDR, SOAR, EDR and Thor APT), including evaluation, design and implementation of new solutionssupporting the regional CSIRT Heads with reporting duties, audits, management briefings and the definition and tracking of incident response KPIs and KRIsdelivering against all contractual obligations for the existing CA&RR Service established for ERGO´s international affiliatesperforming other tasks entrusted by superiors, within the scope of the position and possessed competencesSkills and experience you will needfluent Englishacademic degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a comparable field; or equivalent professional qualifications and extensive experience in IT and/or information securityrelevant professional certifications such as GIAC Certified Incident Analyst (GCIA), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Intrusion Hunter (GCIH), GIAC Network Forensic Analyst (GNFA), Offensive Security Certified Professional (OSCP), Certified Information Systems Security Professional (CISSP), or Certified Information Security Manager (CISM) are highly desirableminimum of 7 years in cybersecurity or information security roles, with at least 3 years in a leadership or managerial capacity within threat hunting, incident response, or SOC/CSIRT environmentsproven track record of handling and coordinating complex cybersecurity incidents such as advanced persistent threats (APTs), ransomware attacks, data breaches, and insider threats in large-scale enterprise settingsextensive experience working in corporate group structures and global matrix organizations, managing cross-functional teams and complex IT environmentsdeep understanding of attacker tactics, techniques, and procedures (TTPs) as outlined in frameworks like MITRE ATT&CK, including threat actor behavior and intrusion patternsstrong knowledge of network and endpoint security, operating systems (Windows, Linux), identity and access management, cloud security platforms, and modern security monitoring architectureshands-on experience with digital forensics, malware analysis, log analysis, SIEM, Endpoint Detection & Response (EDR/XDR), Security Orchestration, Automation and Response (SOAR), and other detection and response toolingability to rapidly assess complex technical incidents and lead appropriate containment, eradication, and remediation actionsmethodological and personal competencies: excellent analytical and conceptual skills with the ability to communicate complex technical information clearly and effectively to diverse audiences, from technical teams to senior managementstrong leadership, team building, and stakeholder management abilities, with a collaborative approach to working in globally distributed environmentsstrategic mindset with a focus on continuous improvement, innovation, and maintaining operational excellencePerks & BenefitsLet's be healthyMedical package, sports card, and numerous sports sections – these are some of the benefits that help our employees stay in good shape.Let's be balancedWork-life balance is a key aspect of a healthy workplace. We offer our employees flexible working hours, a confidential employee assistant program, as well as the possibility of remote working. However, staying at home with our in-office gaming room and dog-friendly office in Warsaw won’t be easy.Let's be smartWe organize numerous workshops and training courses. Thanks to hackathons and meetups, our specialists share their expertise with others. Additionally, we have a wide range of digital learning platforms and language courses.Let's be responsibleEach year, we participate in several CSR activities, during which, together with our colleagues, we do our best to create a better future.Let's be funCompany-wide bike races and soccer matches, film marathons in our cinema room or other engaging team-building activities – we got it covered!Let's be diverseEvery team member is valued, regardless of gender, nationality, religious beliefs, disability, age, and sexual orientation or identity. Your qualifications, experience, and mindset are our greatest benefit!