Industry X - IT/OT Consultant ( GN )

XTB is a global company from the financial industry, focusing on online trading of financial instruments. We are the largest FinTech in Poland and a leader in Central and Eastern Europe, and the range of our operations covers several countries, including Asia and South America. At XTB, we focus on the development of our employees, giving them opportunities to gain knowledge and skills in various fields, as well as offering a number of training and development programs. If you are looking for challenges and want to gain valuable experience in an international business environment, XTB is the right place for you.

We are a certified Great Place to Work company.

Responsibilities

• Monitoring compliance with the DORA Regulation (Digital Operational Resilience Act)
• Conducting independent ICT assessments and controls within the Second Line of Defence (2LoD)
  , with a focus on information security, cybersecurity, and IT infrastructure/systems management
• Preparing post‑audit reports
• Identifying ICT risks and assessing their criticality
  from the perspective of operational resilience and regulatory requirements
• Developing recommendations and action points
  that reduce technological and process risks and support compliance with internal policies and external regulations/supervisory guidelines
• Monitoring the implementation of recommendations
  and remediation actions

Requirements

• Experience in one of the following areas:
  IT audit, information security, or cybersecurity
• Practical knowledge of the DORA Regulation
  and readiness to apply it in day‑to‑day work
• Experience in ICT compliance
• Understanding of information security principles
  , including knowledge of
  ISO/IEC 27001
  and
  ISO/IEC 27002
• Knowledge of regulatory and supervisory requirements
  and standards related to risk management, including
  ISO 31000
• Ability to analyse complex issues
  and formulate clear, precise conclusions and recommendations

What we offer

• Stable employment
  in a regulated, fast‑growing financial/fintech environment
• Opportunity to work directly with DORA, ICT risk, and operational resilience frameworks
• Professional development
  through training, certifications, and exposure to complex ICT risk topics
• Real impact
  on the organisation’s security posture and regulatory compliance
• Collaborative environment
  with experts in cybersecurity, ICT risk, and compliance
• Hybrid work model
  (2 x office + remote)
• Attractive compensation package
  , including benefits aligned with company policy
• Modern office location
  with convenient access (e.g., near metro/transport hubs, if relevant)

Job Description
Joining KEYES means giving purpose to your talent.
Are you looking for an environment where technology is not an end in itself, but a lever to build a sustainable future? At
KEYES
, we are not just looking for technical expertise; we are looking for people who share our values.

Do you want to continue your career and grow within one of Belgium’s leading IT companies?

Join
KEYES
as ICT Network Specialist!

KEYES
supports private and public organizations in Belgium and across Europe in their digital transformation by combining business expertise, technological mastery, and a long-term vision.

We support large enterprises, the public sector, healthcare organizations, and SMEs in all their digital challenges
: Infrastructure & Cloud Solutions, Cybersecurity Solutions, Business Software Solutions, Mainframe Solutions, Data & AI Solutions, Advisory Solutions, and Staffing Solutions.
More information: www.keyes.eu

THE BACKGROUND
For our customer based in
Warsaw, Poland -
an European Institution, we are looking for
ICT Network Specialist
to join a long-term mission in the area of
cybersecurity, public sector
and
law enforcement
. You will play a key role in managing business architecture, guiding solution designs, and fostering collaboration among business architects and project teams to ensure coherence with the customer’s long-term vision.

YOUR MISSION
Please note that, as the role is hybrid, it requires on‑site presence at the client’s headquarters in Warsaw, and you must be located within a 2–3 hour radius from Warsaw by ground transportation.
Your Responsibilities Will Be As Follows

• Administering, monitoring and troubleshoot IP networks
• Administering the structural cabling system
• Performing changes in physical and logical network configuration, installing and removing devices, cabling connections etc.
• Provide 2nd line support to Client’s system and network users
• Create and update the technical documentation and operating procedures
• Advice possible network improvements, changes or upgrades to the network infrastructure

#TRASYS

Job Requirements
YOUR PROFILE

• University degree Bachelor’s degree
• English level B2 (must either hold a certificate or be open to obtain one)

Technical Knowledge Mastered Or To Be Developed Together

• Very good understanding of TCP/IP protocols and IP routing
• Very good understanding of Ethernet switching protocols
• Good knowledge of network services like DNS, DHCP, NTP, etc.
• Good understanding of the wired and wireless access technologies (wifi, 802.1x/EAP etc.)
• Good understanding of the application-layer authentication and encryption mechanisms, e.g. HTTPS/SSL/TLS protocols, PKI and X.509 certificates
• Hands-on experience with the products and solutions related to the domain (e.g. Cisco routers and switches, wireless controllers, network firewalls etc.)
• Hands-on experience in administering of a large enterprise network
• Valid certification relevant to the domain and professional experience e.g. minimum CCNA or equivalent
• Good knowledge of the network configuration of the endpoint operating systems (Windows, Linux, IOS etc.)
• Work experience with stateful and stateless traffic filtering

Soft Skills

• A proactive attitude and team-work spirit
• Very good analytical and trouble-shooting skills
• Sound communication skills, both technical and non-technical

Do you recognise yourself in this description?

Do you want to learn more?

Apply now! You will be contacted shortly.

Cybersecurity Operations Team
– created as part of the EY Cybersecurity practice in Poland, provides services in the field of security monitoring, threat detection and response, and vulnerability management, with particular focus on the SOC and Vulnerability Management space across on-premises, public and private cloud, and hybrid environments. The team is also responsible for the ongoing operation and optimization of security monitoring and vulnerability management processes for clients across various industries.

The team works on complex, international projects, helping organizations detect, investigate, and respond to threats while continuously identifying and reducing their exposure by embedding security operations capabilities into their environments and engineering workflows. Due to the dynamic growth of these services, we are looking for ambitious individuals to join the team as a CyberSecurity Operations Intern.

Opportunities that await you:
As a CyberSecurity Operations Intern, you will actively support internal security initiatives and client projects focused on monitoring, detecting, and responding to threats, as well as identifying and managing vulnerabilities across modern IT environments. You will gain hands-on experience with security operations tooling and learn how threats are detected, investigated, and remediated across SOC and Vulnerability Management functions.

You will work closely with SOC analysts, threat hunters, detection engineers, and vulnerability management specialists, learning how to translate security signals and intelligence into practical, automated, and scalable detection and response capabilities.

Your main tasks:
As a member of the Cybersecurity Operations team, you will take part in many different, interesting projects, mainly related to the design/implementation/operation of security monitoring, threat detection and response capabilities, with a focus on Vulnerability Management and SOC functions (Incident Handling, Threat Hunting, Threat Intelligence, Detection Engineering), including:

• Supporting the Vulnerability Management lifecycle (asset discovery, vulnerability scanning, prioritization, remediation tracking and reporting)
• Operating and maintaining vulnerability scanning tools and integrating them with asset inventory and CMDB data
• Building Vulnerability Management dashboards, metrics and reporting for technical teams and management
• Assisting in security incident handling and response, including triage, investigation, containment and post-incident activities
• Monitoring security alerts and events across SIEM, EDR and other security tooling as an L1/L2 analyst, performing initial triage, validation and prioritization
• Investigating and escalating confirmed incidents according to defined playbooks and SLAs, documenting findings and supporting containment and remediation actions
• Helping design, develop and tune detection content (e.g. SIEM/EDR rules, correlation logic, use cases) as part of Detection Engineering
• Working on end-to-end SOC use case development with field experts
• Helping integrate and automate security tooling via APIs and scripting (e.g. using Python, PowerShell, REST APIs, SOAR playbooks)

Moreover, you will take part in projects focused on the operationalization of CyberSecurity tools such as SIEM / SOAR / EDR and transformation initiatives, which will include tasks such as:

• SOC - daily monitoring, incident detection and response, reporting, and participation in continuous improvement of monitoring capabilities
• Engineering - performing regular updates, maintaining automation scripts, system health checks, supporting platform transformations, and maintaining documentation of security systems
• SOAR - developing and supporting automation workflows, optimizing routine processes, and contributing to incident response efficiency
• Vulnerability Management - conducting continuous scanning, tracking remediation progress, coordinating with system owners, and improving vulnerability management processes
• Cloud Security - performing compliance checks, monitoring security issues, implementing best practices, and cooperating closely with the cloud operations team

Skills you will use:

• Basic understanding of cybersecurity concepts, common attack types, and the CIA triad
• General knowledge of SIEM / SOAR / EDR tools
• General knowledge of Vulnerability Management tools and concepts (e.g. Tenable, Qualys, Rapid7) and CVSS-based risk scoring
• Analytical thinking and problem-solving mindset
• Knowledge of Linux (e.g. RedHat) and Windows including logs, processes and OS internals
• Understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, ports and protocols)
• Very good knowledge of English and Polish

Your previous experience:
Student/Graduate of Cybersecurity or related fields (IT profile)

We will also appreciate:

• Familiarity with alert triage, incident handling and escalation workflows (runbooks/playbooks)
• Basic familiarity with security tools such as CrowdStrike Falcon EDR, CrowdStrike NG-SIEM, LogScale, Splunk, Microsoft Sentinel
• Basic familiarity with VM or security tools such as Tenable, Qualys, Wiz, Rapid7, CrowdStrike, or ServiceNow VR
• Experience or interest in Python, PowerShell, Bash and REST APIs
• Possession of industry certificates in the field of IT security, e.g. CompTIA Security+, certification of leading IT/Security solution providers (also in the areas of security of cloud platforms, e.g. Microsoft AZ-900)
• Willingness to develop in the area of IT security

You are a good fit for us if:
You are a proactive, well-organized person who is genuinely passionate about cybersecurity, follows the latest threats, attack techniques, and industry trends, and wants to develop towards Security Operations, threat detection and response, and vulnerability management. You enjoy investigating how attacks work, are curious about technology and automation, and are ready to take on challenges in international, engineering-driven projects.

We offer:
Interesting work in an international consulting company,

• Locations:Warsaw, Poznań, Kraków, Wrocław and Gdańsk
• Flexible working hours to fit your university schedule
• Hybrid or remote work options, depending on project requirements
• Exposure to a wide range of technologies and projects, allowing you to explore different areas of cybersecurity and find your own career path
• Participation in complex, international projects in the field of implementation of cybersecurity solutions and thus enabling the acquisition of various experiences,
• Opportunity to gain hands-on experience with enterprise-level cybersecurity tools and technologies
• Personalized programs of courses and trainings,
• Participation in a professional development program

About EY Poland
We are a global consulting company – we help entrepreneurs, organizations and communities get the most out of their potential. We carry out projects in the field of: Audit, Tax, Transaction and Business Consulting (including IT).

We employ more than 240,000 exceptional people in more than 150 countries around the world. There are over 2800 of us in Poland, and we work in: Warsaw, Gdańsk, Katowice, Kraków, Łódź, Poznań and Wrocław.

We create amazing things together every day. We have people, a development path and training, thanks to which you can also handle the most prestigious projects.

EY is an equal opportunity employer, we appreciate the diversity of knowledge and experience of our employees.

EY provides all candidates with equal opportunities in the recruitment process, regardless of gender, age, race, religion, sexual orientation, national origin, disability or any other legally protected data, in accordance with applicable law.

Polskie Elektrownie Jądrowe sp. z o.o. to spółka celowa, która odpowiada za bezpośrednie przygotowanie i realizację procesu inwestycyjnego budowy pierwszej polskiej elektrowni jądrowej. Spółka będzie realizowała wszelkie działania w sferze technicznej, technologicznej, organizacyjnej i formalno-prawnej, związane z budową pierwszej elektrowni jądrowej w Polsce.

Obecnie poszukujemy osób na stanowisko: Starsza Analityczka/Starszy Analityk ds. SOC (L2)

Opis stanowiska:

• Monitorowanie i analiza alertów bezpieczeństwa generowanych przez systemy SIEM/XDR/IDS-IPS w czasie rzeczywistym.
• Prowadzenie triage’u zgłoszeń (L2), w tym weryfikacja alertów przekazanych przez L1 oraz pogłębiona analiza kontekstowa incydentów.
• Wstępne zabezpieczanie materiału dowodowego (logów, artefaktów) zgodnie z zasadami łańcucha dowodowego na potrzeby ewentualnej eskalacji do L3/DFIR.
• Identyfikowanie wskaźników kompromitacji (IOC) oraz mapowanie aktywności na taktyki i techniki MITRE ATT&CK.
• Tworzenie i aktualizacja reguł korelacyjnych, przypadków użycia (use cases) oraz dostrajanie systemów detekcyjnych w celu ograniczenia liczby fałszywych alarmów (false positives).
• Dokumentowanie przebiegu obsługi incydentów oraz tworzenie raportów poincydentalnych (analiz post-mortem).
• Udział w cyklicznych przeglądach skuteczności detekcji oraz w procesie doskonalenia rozwiązań po obsłużonych incydentach (lessons learned).
• Wykonywanie analiz OSINT z zachowaniem zasad OPSEC.
• Wsparcie w utrzymaniu i rozwoju narzędzi SOC.
• Mentoring i wsparcie merytoryczne Analityków L1.
• Udział w szkoleniach, warsztatach, konferencjach oraz ćwiczeniach wewnętrznych i zewnętrznych, z inicjatywy pracodawcy lub własnej.

Wymagania:

• Wykształcenie średnie techniczne, w trakcie studiów lub wyższe (informatyka, cyberbezpieczeństwo, inżynieria komputerowa, telekomunikacja lub kierunki pokrewne).
• Znajomość metodyki reagowania na incydenty zgodnie z NIST SP 800-61 Rev. 2.
• Podstawowa znajomość NIST Cybersecurity Framework (CSF 2.0).
• Znajomość MITRE ATT&CK.
• Znajomość zagadnień związanych z OSINT i OPSEC.
• Znajomość zasad klasyfikacji i priorytetyzacji incydentów (triage) oraz kryteriów eskalacji do zespołów L3/DFIR.
• Znajomość podstaw analizy malware, w tym rozpoznawania typowych artefaktów, korzystania z sandboxów oraz analizy sygnatur.
• Znajomość zagadnień compliance istotnych dla pracy SOC, w szczególności NIS2, KSC, ISO/IEC 27001 oraz RODO.
• Znajomość architektury sieci, protokołów sieciowych oraz systemów Windows i Linux.
• Znajomość środowisk chmurowych w kontekście monitorowania bezpieczeństwa.
• Znajomość zasad korelacji zdarzeń oraz tworzenia i dostrajania reguł detekcji.
• Minimum 2-3 lata doświadczenia na stanowisku Analityka SOC (L1/L2) lub stanowisku pokrewnym.
• Doświadczenie w samodzielnej analizie i obsłudze alertów generowanych przez systemy SIEM/XDR.
• Praktyczna znajomość systemów klasy SIEM, SOAR oraz EDR/XDR.
• Znajomość narzędzi do analizy ruchu sieciowego, np. Wireshark.
• Znajomość platform i baz CTI, np. VirusTotal, MISP oraz AbuseIPDB.
• Znajomość narzędzi OSINT.
• Znajomość systemów ticketowych.
• Podstawowa znajomość skryptowania w językach Python, PowerShell i Bash.
• Znajomość języka angielskiego na poziomie minimum B2.
• Zgodnie z regulacjami obowiązującymi w Spółce każdy pracownik po zatrudnieniu musi posiadać poświadczenie bezpieczeństwa osobowego upoważniające do dostępu do informacji niejawnych oznaczonych klauzulą co najmniej „poufne” lub wyrazić gotowość do poddania się, po zatrudnieniu, postępowaniu sprawdzającemu w celu uzyskania takiego poświadczenia.

Mile widziane:

• Doświadczenie zdobyte w organizacjach funkcjonujących w środowisku regulowanym wymaganiami NIS2 i KSC.
• Certyfikaty branżowe, takie jak CompTIA Security+, CySA+, GCIH, GSOC, eCIR, Blue Team Level 1 lub równoważne.

Oferujemy:

• Możliwości rozwoju zawodowego oraz ciekawe wyzwania.
• Udział w unikalnym na skalę Polski projekcie inwestycyjnym o charakterze strategicznym.
• Praca w ambitnym i dynamicznie rozwijającym się zespole.
• Atmosferę wsparcia i współpracy.
• Atrakcyjne wynagrodzenie i system nagradzania.
• Benefity pozapłacowe.
• Umowę o pracę.
• Praca hybrydowa zgodnie z zasadami obowiązującymi u pracodawcy, w Warszawie.
• Wynagrodzenie zasadnicze brutto: 13 000-15 000 zł/mies.

Informujemy, że nazwa stanowiska użyta w niniejszym ogłoszeniu ma charakter rekrutacyjny i służy uproszczeniu identyfikacji roli na rynku pracy. Stanowisko, na które zostanie zatrudniona wybrana osoba, może funkcjonować w organizacji pod inną nazwą zgodną z wewnętrzną strukturą i systematyką stanowisk.