Head of Threat Hunting / CARR | f/m/d

About Us

ERGO Technology & Services S.A. delivers integrated IT and business services to international markets, focusing on modern, business-driven technology solutions. The organization also supports end-to-end insurance processes, including finance, operations, and underwriting, in a dynamic, multicultural environment with international opportunities.

About the Role

The Head of the Global Threat Hunting Team safeguards the organization against sophisticated cyber threats by leading a specialized team focused on proactive threat hunting and mitigation. The role ensures the early identification of emerging and advanced threats before they affect business operations, reducing risk and protecting digital assets worldwide.

The position establishes and drives a world-class threat hunting function that enhances defensive capabilities through advanced techniques, threat intelligence, and cross-functional collaboration. It cultivates vigilance, innovation, and operational excellence, aligning threat hunting with the broader security strategy and business goals.

By championing proactive threat discovery and mitigation, the role supports business continuity, customer trust, and global cybersecurity resilience.

How You Will Get the Job Done

• Lead, mentor, and develop a high-performing global team of threat hunting professionals.
• Design and implement proactive threat hunting methodologies to identify and mitigate advanced cyber threats.
• Collaborate with incident response, security operations, and intelligence teams to improve the overall security posture.
• Analyze emerging threat trends, develop actionable intelligence, and communicate findings to stakeholders.
• Establish and maintain threat hunting frameworks, tools, and best practices.
• Ensure threat hunting activities align with organizational security policies and business objectives.
• Manage and prioritize team workload to ensure timely threat detection and response.
• Drive continuous improvement and innovation within the threat hunting program.
• Coordinate with global security teams to ensure 8x5 threat hunting coverage and incident escalations.
• Support major cyber incidents through reactive threat hunting activities.
• Consolidate and interpret technical results and data for the Head of CSIRT APAC and other stakeholders to support timely, well-founded decisions.
• Prepare clear, audience-appropriate communications and reports on threat findings for senior management, risk and compliance functions, and technical teams.
• Drive the development and optimization of threat hunting processes, guidelines, procedures, metrics, and documentation.
• Evolve the team's technical capabilities, including SIEM, EDR/XDR, SOAR, EDR, and Thor APT; evaluate, design, and implement new solutions.
• Support regional CSIRT Heads with reporting, audits, management briefings, and the definition and tracking of incident-response KPIs and KRIs.
• Deliver all contractual obligations for the existing CA&RR Service for international affiliates.
• Perform other tasks assigned by superiors within the scope of the role and possessed competencies.

Skills and Experience You Will Need

• Fluent English.
• An academic degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a comparable field; or equivalent professional qualifications and extensive IT and/or information-security experience.
• Relevant certifications such as GCIA, GCFA, GCIH, GNFA, OSCP, CISSP, or CISM are highly desirable.
• At least 7 years of cybersecurity or information-security experience, including at least 3 years in a leadership or managerial role in threat hunting, incident response, or SOC/CSIRT environments.
• A proven record of handling and coordinating complex incidents, including APTs, ransomware, data breaches, and insider threats, in a large-scale enterprise environment.
• Extensive experience in corporate group structures and global matrix organizations, managing cross-functional teams and complex IT environments.
• Deep understanding of attacker tactics, techniques, and procedures under frameworks such as MITRE ATT&CK, including threat-actor behavior and intrusion patterns.
• Strong knowledge of network and endpoint security, Windows and Linux operating systems, identity and access management, cloud security platforms, and modern security monitoring architectures.
• Hands-on experience with digital forensics, malware analysis, log analysis, SIEM, EDR/XDR, SOAR, and other detection and response tools.
• Ability to rapidly assess complex technical incidents and lead containment, eradication, and remediation.
• Excellent analytical and conceptual skills, with the ability to explain complex technical information clearly to technical teams and senior management.
• Strong leadership, team-building, and stakeholder-management skills, with a collaborative approach in globally distributed environments.
• A strategic mindset focused on continuous improvement, innovation, and operational excellence.

Perks & Benefits

Let's Be Healthy

Medical package, sports card, and numerous sports sections that help employees stay in good shape.

Let's Be Balanced

Flexible working hours, a confidential employee assistance program, remote-working options, an in-office gaming room, and a dog-friendly Warsaw office.

Let's Be Smart

Workshops, training courses, hackathons, meetups, digital learning platforms, and language courses.

Let's Be Responsible

Opportunities to participate in annual CSR activities.

Let's Be Fun

Company-wide bike races and soccer matches, film marathons in the cinema room, and other team-building activities.

Let's Be Diverse

Every team member is valued regardless of gender, nationality, religious beliefs, disability, age, sexual orientation, or identity. Qualifications, experience, and mindset are valued.