Cybersecurity Specialist

We offer:

• Attractive remuneration
• Stable employment in a company with an established market position.
• Flexible forms of employment and hybrid work.
• Advanced technology stack in the area of security.
• Short decision-making path and a partnership approach - you have a real voice in the choice of tools and security direction.
• Support from an experienced team of administrators and close cooperation within the CSIRT team and people responsible for compliance.
• Room for skills development and certifications.
• Gaining experience in a regulated, demanding healthcare sector.
• Unlimited access to coffee, friendly atmosphere and a modern office, and most importantly - no parking problems

Responsibilities:

• SIEM/SOC - you maintain SIEM as the core of the internal SOC and the SOC services provided to clients: you connect and normalize log sources, create your own detection and correlation rules, and tune automatic responses (Active Response).
• Detection and incident response - you handle alerts from agent-based XDR host monitoring, analyze anomalies and conduct incident response per IR procedures (event/incident/failure classification, CIA analysis, intervention actions).
• Vulnerability management - you run periodic scans with an authorized scanner, triage results (CVE/CVSS/KEV) and coordinate remediation with technical teams and report their status.
• Identity, access and secrets - you maintain MFA/2FA and VPN, develop privileged account management (PAM) in a least-privilege model and maintain a password vault: policies, service password rotation, roles and access audit.
• Server and container security - you administer Linux servers and harden them per CIS guidelines, secure SSH access (keys, protection against dictionary attacks), automate repetitive tasks (e.g., CRON/Bash/Python) and secure container environments (Docker, LXC/LXD).
• Backups - you design and maintain backups of critical systems and their configurations in a 3-2-1 model, schedule and monitor jobs, run periodic restore tests, protect backups from ransomware effects and manage their encryption and retention per continuity policies.
• Network - you ensure network segmentation (e.g., OT, backup/DC, corporate and medical networks, VoIP/PBX, mgmt) and iptables/nftables rules, and support device monitoring via SNMP.
• Cryptographic posture - you manage the TLS/SSL certificate lifecycle and internal PKI/CA, enforce secure protocols and cipher suites on services (web, mail, VPN, SSH), oversee key management (rotation, secure storage, access control) and encryption at rest and in transit, and detect and eliminate weak cryptography.
• Mail - you secure the mail system: anti-spam, enforcing password policies and tuning.
• Security awareness - you build and run campaigns and phishing simulations (custom scenarios, test environment, data minimization), analyze effectiveness and train employees.
• Compliance and documentation - you co-develop security policies and procedures and ISMS documentation (playbooks, registers, reports) in line with NIS2/uKSC and ISO 27001