Job Description

Imagine a future where you protect critical renewable energy operations by leading the response to complex cyber security incidents

Join us in this role where you’ll lead and investigate cyber security incidents across IT and OT environments. You’ll use your deep technical expertise to understand what happened, determine the root cause and impact, coordinate an effective response, and turn complex findings into clear recommendations for stakeholders. You’ll also help develop our threat hunting, forensic investigation, and incident response capabilities.

Welcome to Cyber Defence Centre

You’ll be part of Cyber Defence Centre where you, together with your colleagues, will act as the final escalation point when Ørsted faces a cyber security incident. You’ll work across IT and OT environments and collaborate with security specialists, technical teams, external partners, and other stakeholders to investigate and coordinate our response to cyber threats.

As a team, we work closely, share what we learn, and continuously strengthen how we respond. Between incidents, you’ll have the freedom to deepen your expertise through threat hunting, exercises, developing tools and methodologies, and improving how the team operates.

You’ll play an important role in:

• leading and carrying out technical investigations of cyber security incidents across global IT and OT environments
• analyzing logs, network and endpoint data, forensic evidence, and other technical information to establish root cause, scope, and impact
• coordinating incident response across technical teams and translating complex findings into clear information and recommendations for stakeholders
• designing and carrying out intelligence-led threat hunting and forensic investigations
• documenting investigations, lessons learned, and incident timelines, and continuously improving incident response playbooks and procedures
• taking part in a compensated, rotating on-call scheme that maintains the team’s readiness to respond to significant cyber security incidents outside normal working hours.

To succeed in the role, you:

• have strong hands-on experience investigating and responding to cyber security incidents, including containment, root cause analysis, and coordination of response activities
• have deep technical knowledge of computer systems, networks, endpoints, and cyber security, and can investigate complex incidents methodically using different sources of technical evidence
• are experienced with security monitoring and investigation technologies such as SIEM, XDR or EDR, and can confidently analyses logs and other technical data
• have experience with threat hunting, digital forensics, or related investigative activities, and can turn findings into practical improvements
• communicate complex technical issues clearly and confidently to both technical colleagues and senior stakeholders, including when decisions need to be made under pressure
• work independently, prioritize effectively during incidents, share your knowledge with colleagues, and have a strong interest in continually developing your cyber security expertise.
• Maybe you’ve read the above and can see you have some transferable skills, even though they don’t quite match all the points. If you think you can bring something to the team, we still encourage you to apply.
• Shape the future with us
• Send your application to us as soon as possible. We’ll be conducting interviews on a continuous basis and reserve the right to take down the advert when we’ve found the right candidate.
• As an applicant or employee, you may request reasonable work and position accommodation or adjustments via accommodation@orsted.com.
• Please note that for your application to be taken into consideration, you must submit your application via our online career pages and answer the screening questions relevant for your country. We don't take applications or inquiries from external recruiters or agencies into account for this position.

Position salary range:

For this position, the expected base pay range is zł22,183.00- zł33,274.00 for the advertised location. The offered base salary will be determined within this range based on relevant skills, experience, and expected role fulfilment within the stated pay range to ensure a fair and competitive offer. Where applicable, you may also be eligible for variable payment and a comprehensive benefits package.

Our benefits package:

Our benefits package: For this position, employees who meet eligibility requirements have access to: private healthcare (Medicover and CM Damiana) fully paid by the employer, with optional add-ons (dental care, senior packages, parents/parents-in-law cover); group life insurance, overseas health insurance, and 24/7 accident insurance from day one; access to an employee pension plan (PPE) with a 3.5 % employer contribution after 6 months; a vacation bonus of PLN 1200 once per year; a multimedia package (mobile phone and laptop or tablet); ergonomics support, health apps, and psychological support via Wellbee; a Multisport card and the MyBenefit cafeteria system with a wide range of sports and lifestyle benefits; free fruit and beverages, team events, and company initiatives; glasses subsidy.

Pre-employment background check:

This position requires a background check as part of the hiring process and the offer is dependent on the outcome of this check. You will receive more information during the recruitment process. Background checks are conducted by an external provider in accordance with local legal requirements.