Vacancy details
This is a private vacancy. Company details stay confidential until InVault confirms a serious candidate fit.
- Status
- Active
- Date posted
- 2026-11-15
- Open until
- 2027-02-13
- Employment type
- Full-time
- Source-listed languages
- Not specified
- Language requirement
- No mandatory language inferred
- Work arrangement
- Remote
- Physical workplaces
- Not specified
- Applicant eligibility
- Poland
Overview
Build security monitoring across a digital-asset infrastructure stack combining enterprise cloud systems, Ethereum Layer 2 networks and onchain applications. Operate SIEM detections, investigate exploitation signals and coordinate incident containment with protocol and infrastructure engineering teams.
Requirements
- Three to five or more years of security operations, detection engineering or incident response experience in cloud-native or Web3 environments.
- Hands-on monitoring and incident analysis with AWS GuardDuty, CloudTrail and enterprise IT systems such as identity and collaboration SaaS.
- Direct experience using Web3 onchain monitoring tools such as Hypernative, Hexagate and Blockaid.
- Strong knowledge of Ethereum, Layer 2 security, ZK-rollup infrastructure and smart-contract vulnerabilities.
- Proficiency with logging and incident tools such as Grafana, SIEM and SOAR, plus scripting in Python, Go, Bash or SQL.
- Familiarity with SOC 2, ISO 27001, NIST or SANS security frameworks.
- Strong investigative communication, security analysis and cross-functional problem-solving skills.
Responsibilities
- Build and maintain centralized cloud and SaaS security logging, SIEM and alerting.
- Monitor blockchain sequencers, RPC services, L1/L2 messaging and rollup infrastructure telemetry.
- Detect malicious smart-contract activity, bridge abuse, flash-loan patterns and liquidity exploits.
- Investigate cloud and onchain threats and coordinate incident containment and root-cause analysis.
- Automate response playbooks and tune detection rules to reduce false positives.
- Maintain audit-ready incident and forensic records and share threat intelligence with engineering and security partners.
- Participate in security incident response coverage across distributed infrastructure.
Conditions
- Full-time fully remote position for candidates based in Poland within the European hiring region.
- Participate in incident response coverage for continuous security monitoring and coordinated on-call response.
Tech stack
- AWS GuardDuty
- CloudTrail
- Hypernative
- SIEM
- Python