Head of Threat Hunting / CARR | f/m/d

About Us

ERGO Technology & Services S.A. (ET&S), a member of the Munich Re and ERGO Group, is delivering integrated IT and business services to international markets. Our expertise lies in providing advanced IT services, with a focus on modern, business-driven technology solutions. On the business side, we also support the Group in various end-to-end insurance processes, including finance, operations, and underwriting. With offices in Warsaw and Gdansk, and strong global partnerships, we foster a dynamic, multicultural environment that promotes diversity and international opportunities.

About the role

The Head of the Global Threat Hunting Team plays a critical role in safeguarding our organization against sophisticated digital cyber threats by leading a specialized team dedicated to proactive threat hunting and mitigation. This position exists to ensure the early identification of emerging and advanced threats before they can impact business operations, thereby reduce risk and protect our valuable digital assets worldwide.

The purpose of this role is to establish and drive a world-class threat hunting function that continuously enhances our defensive capabilities by leveraging cutting-edge techniques, threat intelligence, and cross-functional collaboration. The manager will cultivate a culture of vigilance, innovation, and operational excellence within the team, aligning threat hunting efforts with the broader security strategy and organizational goals.

By championing proactive threat discovery and mitigation, this role directly contributes to maintaining business continuity, safeguarding customer trust, and fortifying our position as a leader in cybersecurity resilience on a global scale.

How you will get the job done

• leading, mentoring, and developing a high-performing global team of threat hunting professionals

• designing and implementing proactive threat hunting methodologies to identify and mitigate advanced cyber threats

• collaborating with incident response, security operations, and intelligence teams to improve overall security posture

• analyzing emerging threat trends, develop actionable intelligence, and communicate findings to stakeholders

• establishing and maintaining threat hunting frameworks, tools, and best practices

• ensuring alignment of threat hunting activities with organizational security policies and business objectives

• managing and prioritizing team workload, ensuring timely detection and response to threats

• driving continuous improvement initiatives and innovation within the threat hunting program

• coordinating with global security teams to ensure 8x5 threat hunting coverage and incident escalation

• supporting major cyber incidents with reactive threat hunting activities

• consolidating and interpreting technical results and data for Head of CSIRT APAC and other stakeholders to support timely and well‑founded decision‑making

• preparing clear, audience‑appropriate communication and reporting on threat findings for different stakeholder groups, including senior management, risk/compliance functions and technical teams

• driving the ongoing development and optimization of Threat Hunting processes, guidelines, procedures, metrics, and documentation

• driving the evolution of the Threat Hunting team technical capabilities (e.g. SIEM, EDR/XDR, SOAR, EDR and Thor APT), including evaluation, design and implementation of new solutions

• supporting the regional CSIRT Heads with reporting duties, audits, management briefings and the definition and tracking of incident response KPIs and KRIs

• delivering against all contractual obligations for the existing CA&RR Service established for ERGO´s international affiliates

• performing other tasks entrusted by superiors, within the scope of the position and possessed competences

Skills and experience you will need

• fluent English

• academic degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a comparable field; or equivalent professional qualifications and extensive experience in IT and/or information security

• relevant professional certifications such as GIAC Certified Incident Analyst (GCIA), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Intrusion Hunter (GCIH), GIAC Network Forensic Analyst (GNFA), Offensive Security Certified Professional (OSCP), Certified Information Systems Security Professional (CISSP), or Certified Information Security Manager (CISM) are highly desirable

• minimum of 7 years in cybersecurity or information security roles, with at least 3 years in a leadership or managerial capacity within threat hunting, incident response, or SOC/CSIRT environments

• proven track record of handling and coordinating complex cybersecurity incidents such as advanced persistent threats (APTs), ransomware attacks, data breaches, and insider threats in large-scale enterprise settings

• extensive experience working in corporate group structures and global matrix organizations, managing cross-functional teams and complex IT environments

• deep understanding of attacker tactics, techniques, and procedures (TTPs) as outlined in frameworks like MITRE ATT&CK, including threat actor behavior and intrusion patterns

• strong knowledge of network and endpoint security, operating systems (Windows, Linux), identity and access management, cloud security platforms, and modern security monitoring architectures

• hands-on experience with digital forensics, malware analysis, log analysis, SIEM, Endpoint Detection & Response (EDR/XDR), Security Orchestration, Automation and Response (SOAR), and other detection and response tooling

• ability to rapidly assess complex technical incidents and lead appropriate containment, eradication, and remediation actions

• methodological and personal competencies: excellent analytical and conceptual skills with the ability to communicate complex technical information clearly and effectively to diverse audiences, from technical teams to senior management

• strong leadership, team building, and stakeholder management abilities, with a collaborative approach to working in globally distributed environments

• strategic mindset with a focus on continuous improvement, innovation, and maintaining operational excellence

Perks & Benefits

Let's be healthy

Medical package, sports card, and numerous sports sections – these are some of the benefits that help our employees stay in good shape.

Let's be balanced

Work-life balance is a key aspect of a healthy workplace. We offer our employees flexible working hours, a confidential employee assistant program, as well as the possibility of remote working. However, staying at home with our in-office gaming room and dog-friendly office in Warsaw won’t be easy.

Let's be smart

We organize numerous workshops and training courses. Thanks to hackathons and meetups, our specialists share their expertise with others. Additionally, we have a wide range of digital learning platforms and language courses.

Let's be responsible

Each year, we participate in several CSR activities, during which, together with our colleagues, we do our best to create a better future.

Let's be fun

Company-wide bike races and soccer matches, film marathons in our cinema room or other engaging team-building activities – we got it covered!

Let's be diverse

Every team member is valued, regardless of gender, nationality, religious beliefs, disability, age, and sexual orientation or identity. Your qualifications, experience, and mindset are our greatest benefit!