Head of Threat Hunting / CARR | f/m/d w Gdańsk, Polska

About the role

The Head of the Global Threat Hunting Team plays a critical role in safeguarding our organization against sophisticated digital cyber threats by leading a specialized team dedicated to proactive threat hunting and mitigation. This position exists to ensure the early identification of emerging and advanced threats before they can impact business operations, thereby reduce risk and protect our valuable digital assets worldwide.

The purpose of this role is to establish and drive a world-class threat hunting function that continuously enhances our defensive capabilities by leveraging cutting-edge techniques, threat intelligence, and cross-functional collaboration. The manager will cultivate a culture of vigilance, innovation, and operational excellence within the team, aligning threat hunting efforts with the broader security strategy and organizational goals.

By championing proactive threat discovery and mitigation, this role directly contributes to maintaining business continuity, safeguarding customer trust, and fortifying our position as a leader in cybersecurity resilience on a global scale.

How you will get the job done

• leading, mentoring, and developing a high-performing global team of threat hunting professionals
• designing and implementing proactive threat hunting methodologies to identify and mitigate advanced cyber threats
• collaborating with incident response, security operations, and intelligence teams to improve overall security posture
• analyzing emerging threat trends, develop actionable intelligence, and communicate findings to stakeholders
• establishing and maintaining threat hunting frameworks, tools, and best practices
• ensuring alignment of threat hunting activities with organizational security policies and business objectives
• managing and prioritizing team workload, ensuring timely detection and response to threats
• driving continuous improvement initiatives and innovation within the threat hunting program
• coordinating with global security teams to ensure 8x5 threat hunting coverage and incident escalation
• supporting major cyber incidents with reactive threat hunting activities
• consolidating and interpreting technical results and data for Head of CSIRT APAC and other stakeholders to support timely and well‑founded decision‑making
• preparing clear, audience‑appropriate communication and reporting on threat findings for different stakeholder groups, including senior management, risk/compliance functions and technical teams
• driving the ongoing development and optimization of Threat Hunting processes, guidelines, procedures, metrics, and documentation
• driving the evolution of the Threat Hunting team technical capabilities (e.g. SIEM, EDR/XDR, SOAR, EDR and Thor APT), including evaluation, design and implementation of new solutions
• supporting the regional CSIRT Heads with reporting duties, audits, management briefings and the definition and tracking of incident response KPIs and KRIs
• delivering against all contractual obligations for the existing CA&RR Service established for ERGO´s international affiliates
• performing other tasks entrusted by superiors, within the scope of the position and possessed competences

Skills and experience you will need

• fluent English
• academic degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a comparable field; or equivalent professional qualifications and extensive experience in IT and/or information security
• relevant professional certifications such as GIAC Certified Incident Analyst (GCIA), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Intrusion Hunter (GCIH), GIAC Network Forensic Analyst (GNFA), Offensive Security Certified Professional (OSCP), Certified Information Systems Security Professional (CISSP), or Certified Information Security Manager (CISM) are highly desirable
• minimum of 7 years in cybersecurity or information security roles, with at least 3 years in a leadership or managerial capacity within threat hunting, incident response, or SOC/CSIRT environments
• proven track record of handling and coordinating complex cybersecurity incidents such as advanced persistent threats (APTs), ransomware attacks, data breaches, and insider threats in large-scale enterprise settings
• extensive experience working in corporate group structures and global matrix organizations, managing cross-functional teams and complex IT environments
• deep understanding of attacker tactics, techniques, and procedures (TTPs) as outlined in frameworks like MITRE ATT&CK, including threat actor behavior and intrusion patterns
• strong knowledge of network and endpoint security, operating systems (Windows, Linux), identity and access management, cloud security platforms, and modern security monitoring architectures
• hands-on experience with digital forensics, malware analysis, log analysis, SIEM, Endpoint Detection & Response (EDR/XDR), Security Orchestration, Automation and Response (SOAR), and other detection and response tooling
• ability to rapidly assess complex technical incidents and lead appropriate containment, eradication, and remediation actions
• methodological and personal competencies: excellent analytical and conceptual skills with the ability to communicate complex technical information clearly and effectively to diverse audiences, from technical teams to senior management
• strong leadership, team building, and stakeholder management abilities, with a collaborative approach to working in globally distributed environments
• strategic mindset with a focus on continuous improvement, innovation, and maintaining operational excellence

About Us

ERGO Technology & Services S.A. (ET&S), a member of the Munich Re and ERGO Group, is delivering integrated IT and business services to international markets. Our expertise lies in providing advanced IT services, with a focus on modern, business-driven technology solutions. On the business side, we also support the Group in various end-to-end insurance processes, including finance, operations, and underwriting. With offices in Warsaw and Gdansk, and strong global partnerships, we foster a dynamic, multicultural environment that promotes diversity and international opportunities.