Cybersecurity Specialist
⚲ Katowice
12 000 - 15 000 PLN (B2B / UoP)
Wymagania
- Linux
- Docker
- Python
- Shell
Opis stanowiska
Our client is a company operating at the intersection of healthcare and technology, providing comprehensive solutions for medical facilities. Their portfolio includes high-quality medical devices, technical infrastructure, and dedicated IT systems that support diagnostics and the daily operations of healthcare units. The company also offers after-sales support — remote assistance, service, and commercial support — making their solutions ready for deployment and maintenance in demanding clinical environments. Headquartered in Katowice, their communications are aimed at professionals working with medical devices. This is an attractive workplace for IT specialists, biomedical engineers and sales professionals who want to work on projects that combine IT technologies with real healthcare needs.
Cybersecurity Specialist
We offer:
- Attractive remuneration
- Stable employment in a company with an established market position.
- Flexible forms of employment and hybrid work.
- Advanced technology stack in the area of security.
- Short decision-making path and a partnership approach - you have a real voice in the choice of tools and security direction.
- Support from an experienced team of administrators and close cooperation within the CSIRT team and people responsible for compliance.
- Room for skills development and certifications.
- Gaining experience in a regulated, demanding healthcare sector.
- Unlimited access to coffee, friendly atmosphere and a modern office, and most importantly - no parking problems
Responsibilities:
- SIEM/SOC - you maintain SIEM as the core of the internal SOC and the SOC services provided to clients: you connect and normalize log sources, create your own detection and correlation rules, and tune automatic responses (Active Response).
- Detection and incident response - you handle alerts from agent-based XDR host monitoring, analyze anomalies and conduct incident response per IR procedures (event/incident/failure classification, CIA analysis, intervention actions).
- Vulnerability management - you run periodic scans with an authorized scanner, triage results (CVE/CVSS/KEV) and coordinate remediation with technical teams and report their status.
- Identity, access and secrets - you maintain MFA/2FA and VPN, develop privileged account management (PAM) in a least-privilege model and maintain a password vault: policies, service password rotation, roles and access audit.
- Server and container security - you administer Linux servers and harden them per CIS guidelines, secure SSH access (keys, protection against dictionary attacks), automate repetitive tasks (e.g., CRON/Bash/Python) and secure container environments (Docker, LXC/LXD).
- Backups - you design and maintain backups of critical systems and their configurations in a 3-2-1 model, schedule and monitor jobs, run periodic restore tests, protect backups from ransomware effects and manage their encryption and retention per continuity policies.
- Network - you ensure network segmentation (e.g., OT, backup/DC, corporate and medical networks, VoIP/PBX, mgmt) and iptables/nftables rules, and support device monitoring via SNMP.
- Cryptographic posture - you manage the TLS/SSL certificate lifecycle and internal PKI/CA, enforce secure protocols and cipher suites on services (web, mail, VPN, SSH), oversee key management (rotation, secure storage, access control) and encryption at rest and in transit, and detect and eliminate weak cryptography.
- Mail - you secure the mail system: anti-spam, enforcing password policies and tuning.
- Security awareness - you build and run campaigns and phishing simulations (custom scenarios, test environment, data minimization), analyze effectiveness and train employees.
- Compliance and documentation - you co-develop security policies and procedures and ISMS documentation (playbooks, registers, reports) in line with NIS2/uKSC and ISO 27001
Requirements:
- Minimum 2 years of experience in the field of IT cybersecurity.
- Very good knowledge of Linux systems: administration, hardening according to CIS guidelines, secure SSH configuration and automation.
- Practical implementation and maintenance of SIEM and agent-based XDR - from onboarding and log normalization, through detection rules and correlation, to dashboards and incident response procedures.
- Experience in vulnerability management: scanning with an authorized scanner, triage of results, knowledge of CVE/CVSS/KEV and coordination of remediation.
- Knowledge of networking topics needed for security and segmentation: TCP/IP, VLAN, network segmentation, routing, VPN, iptables/nftables and SNMP.
- Management of cryptographic posture, TLS/SSL certificates and PKI (lifecycle, renewal, revocation), hardening of protocols and cipher suites, key management and encryption of data at rest and in transit.
- Experience in identity and access management: MFA/2FA, privileged accounts (PAM) in a least-privilege model and password/secret management (password vaults, rotation, policies, audit).
- Maintaining backup systems: 3-2-1 strategy, scheduling and monitoring jobs, recovery testing (RPO/RTO) and protection of backups against ransomware (immutable/offline backups).
- Knowledge of containerization in the context of security (Docker, LXC/LXD).
- Practical knowledge of NIS2/uKSC and ISO 27001 requirements and the ability to document thoroughly (IR procedures, playbooks, ISMS, registers).
- Experience running phishing campaigns and simulations and conducting security trainings.
- Willingness to respond to critical incidents outside standard hours (sporadically, under terms agreed within the CSIRT team).
Additional advantages:
- Knowledge of Microsoft service security topics, in particular Active Directory/LDAPS.
- Knowledge of network monitoring / NDR, including traffic collection architecture (SPAN/TAP) and anomaly analytics.
- Experience with OT industrial protocols
Cybersecurity Specialist
We offer:
- Attractive remuneration
- Stable employment in a company with an established market position.
- Flexible forms of employment and hybrid work.
- Advanced technology stack in the area of security.
- Short decision-making path and a partnership approach - you have a real voice in the choice of tools and security direction.
- Support from an experienced team of administrators and close cooperation within the CSIRT team and people responsible for compliance.
- Room for skills development and certifications.
- Gaining experience in a regulated, demanding healthcare sector.
- Unlimited access to coffee, friendly atmosphere and a modern office, and most importantly - no parking problems
Responsibilities:
- SIEM/SOC - you maintain SIEM as the core of the internal SOC and the SOC services provided to clients: you connect and normalize log sources, create your own detection and correlation rules, and tune automatic responses (Active Response).
- Detection and incident response - you handle alerts from agent-based XDR host monitoring, analyze anomalies and conduct incident response per IR procedures (event/incident/failure classification, CIA analysis, intervention actions).
- Vulnerability management - you run periodic scans with an authorized scanner, triage results (CVE/CVSS/KEV) and coordinate remediation with technical teams and report their status.
- Identity, access and secrets - you maintain MFA/2FA and VPN, develop privileged account management (PAM) in a least-privilege model and maintain a password vault: policies, service password rotation, roles and access audit.
- Server and container security - you administer Linux servers and harden them per CIS guidelines, secure SSH access (keys, protection against dictionary attacks), automate repetitive tasks (e.g., CRON/Bash/Python) and secure container environments (Docker, LXC/LXD).
- Backups - you design and maintain backups of critical systems and their configurations in a 3-2-1 model, schedule and monitor jobs, run periodic restore tests, protect backups from ransomware effects and manage their encryption and retention per continuity policies.
- Network - you ensure network segmentation (e.g., OT, backup/DC, corporate and medical networks, VoIP/PBX, mgmt) and iptables/nftables rules, and support device monitoring via SNMP.
- Cryptographic posture - you manage the TLS/SSL certificate lifecycle and internal PKI/CA, enforce secure protocols and cipher suites on services (web, mail, VPN, SSH), oversee key management (rotation, secure storage, access control) and encryption at rest and in transit, and detect and eliminate weak cryptography.
- Mail - you secure the mail system: anti-spam, enforcing password policies and tuning.
- Security awareness - you build and run campaigns and phishing simulations (custom scenarios, test environment, data minimization), analyze effectiveness and train employees.
- Compliance and documentation - you co-develop security policies and procedures and ISMS documentation (playbooks, registers, reports) in line with NIS2/uKSC and ISO 27001
Requirements:
- Minimum 2 years of experience in the field of IT cybersecurity.
- Very good knowledge of Linux systems: administration, hardening according to CIS guidelines, secure SSH configuration and automation.
- Practical implementation and maintenance of SIEM and agent-based XDR - from onboarding and log normalization, through detection rules and correlation, to dashboards and incident response procedures.
- Experience in vulnerability management: scanning with an authorized scanner, triage of results, knowledge of CVE/CVSS/KEV and coordination of remediation.
- Knowledge of networking topics needed for security and segmentation: TCP/IP, VLAN, network segmentation, routing, VPN, iptables/nftables and SNMP.
- Management of cryptographic posture, TLS/SSL certificates and PKI (lifecycle, renewal, revocation), hardening of protocols and cipher suites, key management and encryption of data at rest and in transit.
- Experience in identity and access management: MFA/2FA, privileged accounts (PAM) in a least-privilege model and password/secret management (password vaults, rotation, policies, audit).
- Maintaining backup systems: 3-2-1 strategy, scheduling and monitoring jobs, recovery testing (RPO/RTO) and protection of backups against ransomware (immutable/offline backups).
- Knowledge of containerization in the context of security (Docker, LXC/LXD).
- Practical knowledge of NIS2/uKSC and ISO 27001 requirements and the ability to document thoroughly (IR procedures, playbooks, ISMS, registers).
- Experience running phishing campaigns and simulations and conducting security trainings.
- Willingness to respond to critical incidents outside standard hours (sporadically, under terms agreed within the CSIRT team).
Additional advantages:
- Knowledge of Microsoft service security topics, in particular Active Directory/LDAPS.
- Knowledge of network monitoring / NDR, including traffic collection architecture (SPAN/TAP) and anomaly analytics.
- Experience with OT industrial protocols
🔍 Dekoder Ogłoszenia
🔴
Short decision-making path and a partnership approach - you have a real voice in the choice of tools and security direction.
Może oznaczać, że decyzje są szybkie, ale też że będziesz musiał przekonywać innych do swoich pomysłów, a wpływ na kierunek bezpieczeństwa może być ograniczony przez inne działy.
🔴
Support from an experienced team of administrators and close cooperation within the CSIRT team and people responsible for compliance.
Wsparcie może oznaczać, że będziesz musiał rozwiązywać problemy zgłaszane przez innych, a współpraca z zespołem ds. zgodności może wiązać się z dużą ilością dokumentacji i procedur.
🟡
Room for skills development and certifications.
Może oznaczać, że firma oferuje budżet na szkolenia i certyfikaty, ale też że rozwój zależy od Twojej inicjatywy i dostępności szkoleń związanych z potrzebami firmy.
🔴
Gaining experience in a regulated, demanding healthcare sector.
Sektor regulowany oznacza potencjalnie dużo biurokracji i ścisłe przestrzeganie przepisów, co może być wyzwaniem dla osób preferujących swobodę działania.
🟡
Flexible forms of employment and hybrid work.
Elastyczność może oznaczać możliwość dostosowania godzin pracy, ale też konieczność pracy w niestandardowych porach w zależności od potrzeb projektu.