Cyber Defence Analyst

Updated on 13/11/2026

Hybrid work from Gdańsk (3 days from the office, 2 remotely)
Long-term, stable contract of employment

About Our Client

Acrisure is a global Fintech leader that combines the best of humans and high tech to offer multiple financial products and services to millions of businesses and individual clients. We connect clients to solutions that help them protect and grow what matters, including Insurance, Reinsurance, Cyber Services, Mortgage Origination and more.

Acrisure employs over 17,000 entrepreneurial colleagues in 21 countries and has grown from $38 million to $4.3 billion in revenue in just over ten years. Our culture is defined by entrepreneurial spirit, innovation, client centricity and an indomitable will to win.

Job Description

Monitor and triage alerts from EDR, SIEM, MDR, email, cloud, identity and other security platforms.
Validate suspicious activity, classify severity, collect initial evidence and escalate according to defined procedures.
Create and maintain accurate cases, actions, timelines, indicators, affected assets and stakeholder communications.
Support containment, eradication and recovery tasks under direction of incident responders.
Perform basic log, endpoint, identity and email analysis and document investigation findings.
Enrich alerts with threat intelligence and map observed behavior to MITRE ATT&CK.
Identify repeat alerts and false positives and recommend tuning or automation opportunities.
Maintain shift/on-call readiness, handover notes and operational dashboards.
Participate in tabletop exercises, training, threat hunts and post-incident reviews.

The Successful Applicant

Minimum qualifications

3+ years in a SOC, security operations, IT operations or incident-response support role.
Working understanding of Windows, Linux, networking, cloud, identity and security monitoring concepts.
Experience with ticketing/case management and disciplined documentation.
Strong analytical, prioritization and communication skills.

Preferred qualifications

Experience with SentinelOne, Microsoft Defender, Google SecOps, ReliaQuest GreyMatter, Abnormal Security or ServiceNow.
Security+, CySA+, SC-200 or equivalent.
Basic PowerShell, Python or KQL.