Gainsight The Lead Security Operations Engineer at Gainsight leads incident response and detection strategy in a cloud-first environment. The role involves mentoring team members and working cross-functionally to embed security controls.
Responsibilities
We’re looking for a full-time Staff Security Operations Engineer to join our Security team reporting to the Senior Manager, AI Response and Threat. This role is a hybrid role based out of Wroclaw, Poland location.
Experienced in owning complex or high-severity incidents end-to-end, from initial triage through containment, remediation, and post-incident review, while keeping stakeholders informed throughout
Deep familiarity with security considerations across AWS, Azure, or GCP environments, including how detection and response strategies need to adapt to cloud-native infrastructure
Lead incident response for significant security events: scoping and containment through to post-incident review. You will conduct host, network, and memory forensics yourself and produce clear, accurate reporting for both technical and non-technical stakeholders.
Comfortable working closely with DevOps and Engineering teams to embed security controls directly into infrastructure, CI/CD pipelines, and system design, rather than layering security on after the fact
Invested in developing the skills and judgment of analysts and engineers on the team, helping the broader group operate with greater independence and technical depth over time
Able to translate complex technical findings into clear, actionable insight for executive leadership, customers, or other non-technical stakeholders, especially under the pressure of an active incident
Experienced in assessing, selecting, and integrating security tools (SIEM, EDR, SOAR, cloud-native platforms) in a way that improves coverage without adding unnecessary complexity or cost
This role may require occasional travel (up to 10-20%) for team meetings, training, or company events. This is not a complete list of responsibilities, and the scope of the role may evolve with the needs of the team and business.
Qualification
Deep expertise with SIEMExcellent communication skillsNice-to-have skills or experience
Required
6+ years of experience in security operations, with progressive responsibility across triage, incident response, and detection engineering
Proven experience leading or mentoring a team, formally or informally, including technical guidance and coaching
Deep expertise with SIEM, EDR, and SOAR platforms, including hands-on rule-writing, tuning, and automation development
Strong incident response leadership experience, including managing complex or high-severity incidents end-to-end
Solid understanding of cloud security architecture (AWS, Azure, or GCP), and experience working with DevOps and Engineering to embed security into CI/CD pipelines and infrastructure
Scripting or automation proficiency (Python, PowerShell, or similar) to build and scale response workflows
Deep familiarity with attacker tactics and techniques (MITRE ATT&CK) and how to translate them into detection logic
Excellent communication skills, with the ability to brief executives and technical teams alike during incidents and planning discussions
Nice-to-have skills or experience:
Hands-on experience with cloud-native detection and posture tools (e.g., AWS GuardDuty, Azure Sentinel, Wiz, Prisma Cloud)
Familiarity with container and orchestration security (Docker, Kubernetes) and associated attack surfaces
Experience with threat intelligence platforms and proactive threat hunting using frameworks like MITRE ATT&CK or Sigma rules
