Cyber Response Technical Team Lead

Aviva is looking for a Cyber Response Technical Team Lead to manage and develop a team of experienced Senior Cyber Security Analysts within its Global Security Operations Centre (GSOC).

This role combines hands-on technical work with people leadership responsibilities. You will develop an existing high-performing team while responding to high-severity and complex incidents alongside your team.

Key responsibilities:

• Lead and manage a team of Senior Cyber Security Analysts/Incident Responders
• Own team performance, engagement, development plans, and career progression
• Provide coaching, mentoring, and technical leadership to enhance team capabilities and expertise
• Coordinate day-to-day activities, workload prioritisation, resource allocation, and team scheduling
• Manage team capacity planning, on-call rotations, shift coverage, and operational readiness
• Act as the primary GSOC escalation point for complex and high-severity cyber security incidents
• Lead and support hands-on investigations, containment, eradication, and recovery activities during cyber incidents
• Provide advanced technical guidance across endpoint, network, cloud, identity, and threat investigations
• Ensure high-quality incident response practices, investigation standards, and operational excellence
• Coordinate incident response activities with internal stakeholders, customers, and other Cyber Security teams
• Drive post-incident reviews and ensure lessons learned are translated into measurable improvements
• Identify skill gaps and develop training, knowledge-sharing, and capability-building initiatives
• Support recruitment, onboarding, succession planning, and retention of cyber security talent within GSOC
• Act as a Subject Matter Expert (SME) in Cyber Security projects, strategic initiatives, and customer engagements
• Provide expert input into the design, implementation, and enhancement of cyber security services and capabilities
• Drive continuous improvement of incident response processes, fine-tuning of detection rules, playbooks, tooling, and operational procedures
• Champion automation initiatives to improve GSOC efficiency, investigation quality, and response times
• Drive adoption and effective use of AI and emerging technologies across GSOC and other relevant areas
• Collaborate with Detection Engineering, Cyber Incident Management, Threat Hunting, Threat Intelligence, Security Engineering, and Product teams to enhance cyber defence capabilities
• Stay current with emerging threats, attacker techniques, and industry best practices to strengthen response capabilities
• Contribute to the strategic development and maturity of the organisation's Cyber Response and Security Operations functions

Requirements:

• 6+ years of experience in Cyber Security, including significant hands-on experience in Security Operations, Incident Response, or DFIR
• Minimum 2 years of proven people management experience, with direct responsibility for team performance, development, engagement, and career progression
• Demonstrated experience managing and developing senior Cyber Security professionals, ideally within a SOC, CSIRT, Cyber Response or Incident Response function
• Proven experience in performance management, coaching, mentoring, development planning, and career progression
• Experience managing team capacity, workload prioritisation, resource allocation, on-call rotations, and operational readiness
• Extensive hands-on experience leading the response to complex and high-severity cyber security incidents, including investigation, containment, eradication, and recovery
• Proven ability to act as a senior technical escalation point during major cyber security incidents and provide leadership under pressure
• Strong technical expertise across multiple security domains, including endpoint, network, identity, cloud, SIEM/XDR, threat hunting, and digital forensics
• Strong understanding of MITRE ATT&CK, attacker TTPs, and modern investigation methodologies
• Experience developing and improving incident response playbooks, investigation standards, detection capabilities, and operational procedures
• Experience driving continuous improvement and automation within Security Operations, including the effective use of SOAR, AI, and emerging technologies
• Strong stakeholder management skills and experience working across multiple Cyber Security and Technology functions
• Ability to communicate complex cyber security matters effectively to both technical and senior business stakeholders
• Fluent Polish and English, both spoken and written
• Experience working in an international environment

Benefits:

• Contract of employment
• Performance Bonus
• Private medical care (ENEL-MED)
• Cafeteria system of benefits (e.g., MultiSport card)
• Additional parent privileges: baby leave – 6 weeks leave for second parent, shortened working time after parental leave
• Employer-funded group insurance
• Employee Shares Plan
• Extra day off for birthday
• Paid time off to volunteer
• Additional leave acquired over the years in the company (even 5 days more in a year)
• Wellbeing Leave - additional two weeks paid leave after 10 years of service
• Psychological support consultations
• Access to e-learning platforms
• Internal employee referral program
• Hybrid working model from Poland with a few days in Warsaw office per month
• Attractive office location in Warsaw - Gdański Business Center
• Additional entitlements for people with disabilities - Work Without Barriers
• Work environment that promotes diversity - Diversity Charter