Security Engineer (Detection & Response)

Work with HelloFresh in Warsaw and its HelloTech organisation, HelloFresh’s global technology backbone with more than 1000 people, building the digital products that power our end-to-end food experience. From meal kits and ready-to-eat meals to specialty offerings like pet food and premium meat & seafood, HelloTech creates the platforms that bring tailored food solutions to millions of customers every month. Our subscription-based, direct-to-consumer model relies on technology at every step, from customer-facing apps and personalization logic to pricing, forecasting, supply chain optimization, and initiatives that help reduce food waste. While our brands operate independently to serve distinct customer needs, they are united by shared platforms, data, and operational excellence built by HelloTech. HelloTech works in autonomous, cross-functional alliances, each owning a specific product or domain end to end. By working with our Warsaw office, you will help shape scalable, data-driven products used across 18 countries, working with a modern tech stack and international teams to continuously improve how people discover, order, and enjoy HelloFresh’s products, today and in the future. — About the role: What's in the Box This journey involves keeping HelloFresh a trusted name—someone with a passion for security and an appetite for new challenges. Security Engineers work in a variety of ways to constantly iterate and improve HelloFresh’s security posture. This role aims to improve the HelloFresh Security Logging & Monitoring Program by maturing the tools, processes, and playbooks to reduce dwell time (indicators of which would be lowered MTTD&R). You will facilitate efficient Incident Detection and Response in AWS cloud and enterprise IT environments. At HelloTech, flexibility and cross-functional collaboration are core to how we work. While this role is aligned to a specific focus area, strong candidates may also be considered for opportunities across different teams or projects. What you’ll do: The Recipe Responsible for SOC monitoring, use-case building, triage, and advisory using cloud-native SIEM platforms. Conduct initial triage of security events and incidents and document progress throughout the Incident Response Lifecycle. Automate, optimize, and operate modern security solutions like EDR/EPPs and conventional Firewalls, IDS/IPS, Email Security, VPN, and MDM tools. Leverage premium and open-source threat intel feeds to regularly sweep environments against rising APT campaigns. Prepare status reports and follow up with the stakeholders through Jira and Incident Mgmt. Platform to close the remediation loop. Contribute to the continuous improvement of security logging and monitoring maturity. What you’ll bring: The Ingredients A minimum of 2 years of experience working in mature SOC environments. Security monitoring and incident response experience in public cloud environments such as AWS. Experience with cloud SIEM & SOAR platforms, DDoS mitigation and prevention tools, and Layer-7 Web-based perimeter security controls. Understanding of network intrusion methods, network containment, segregation techniques, and technologies such as Sandboxes and Intrusion Detection/Prevention Systems (ID/PS). Ability to operate EDR, EPP, and Device Management solutions as per best security practices. Decent programming skills to enable data processing, IaC, and security automations. Good communication and reporting skills. Experience with log analysis stacks like ElasticSearch, Splunk, or SumoLogic. Open to working on-call in rotational shifts. Above all, we are looking for individuals who will make HelloFresh better. We believe there are many different ways of developing skills and we love diverse experiences! So even if you don’t “tick all the boxes” but think you’d thrive in this role, we would really like to learn more about you. What we offer: The Toppings Global collaboration at scale : Collaborate with experienced engineers and product