Information Security Analyst

Information Security Analyst @ Domyn SpABack to all rolesInformation Security AnalystJob detailsBusiness / Platform InfrastructureMilanFull-time€35,000 EUR
- €50,000 EURAs an Information Security Analyst at Domyn, you will be the core operational layer of our security monitoring capability: triaging alerts, investigating security events, and building our SIEM function from the ground up on Microsoft Sentinel. You will extend that visibility across perimeter controls, modern cloud-native infrastructure, and emerging AI-driven attack patterns — working closely with security engineering, DevOps, and governance to keep detection and response continuously improving.

Key responsibilities
* Monitor network and cloud environments for security events, triaging and investigating alerts across SIEM, EDR, and cloud-native logging sources.
* Design, build, and operate a SIEM capability from zero — log source onboarding, workspace and architecture design, correlation and detection rules, use case development — primarily on Microsoft Sentinel; experience with other SIEM platforms (Splunk, QRadar, Elastic, etc.) is a plus.
* Own the full security event lifecycle: detection, triage, investigation, escalation, and remediation tracking.
* Configure and tune perimeter and network security controls — IDS/IPS, Web Application Firewalls (WAF), and next-generation firewalls — and validate their effectiveness against current attack techniques.
* Apply monitoring and detection practices to modern cloud-native and hybrid infrastructure (Azure primarily), including container/Kubernetes environments, IaaS/PaaS logging, and identity-centric attack surfaces.
* Track and analyze AI-related attack patterns on both fronts: attacks that leverage AI (AI-assisted phishing, automated recon, adversarial techniques) and attacks against AI systems (prompt injection, model/data poisoning, jailbreaking).
* Apply the OWASP Top 10 for web applications and the OWASP Top 10 for LLM/GenAI Applications to assess and harden AI-integrated systems.
* Contribute detection use cases, playbooks, and runbooks to continuously mature the security monitoring function.
* Collaborate with security engineering, DevOps, and governance teams to close gaps identified during monitoring and investigation.What You Have* Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience).
* Proven experience in security monitoring, SOC operations, or alert/incident investigation.
* Hands-on experience building or operating a SIEM from scratch, with strong, demonstrable knowledge of Microsoft Sentinel (Log Analytics Workspaces, analytics/detection rules, data connectors); experience with other SIEM platforms is a plus.
* Working knowledge of perimeter and network monitoring controls: IDS/IPS, WAF, next-generation firewalls.
* Solid understanding of cloud security concepts and modern attack techniques applied to cloud environments, primarily Microsoft Azure; familiarity with other major cloud providers (AWS, GCP) is a plus.
* Working knowledge of Identity and Access Management (IAM) principles, both in general and within Azure/GCP (e.g. Entra ID, IAM roles, Conditional Access, privileged access).
* Familiarity with AI security: prompt injection and adversarial ML techniques, and comfort with both the classic OWASP Top 10 and the OWASP Top 10 for LLM Applications.
* Solid horizontal security foundations: networking, vulnerability management, and general security governance principles.
* Proficiency in scripting/query languages such as Python, PowerShell, or KQL (Kusto Query Language) for detection engineering and automation.
* Relevant certifications (e.g., Microsoft SC-200, CompTIA Security+, GIAC GCIA/GCIH, CEH) are a plus.Who You Are* Analytical and detail-oriented. You enjoy connecting the dots across logs and alerts, and you notice the small signals others might miss.
* Cal under pressure: When an incident hits, you stay composed, think clearly and act methodically.
* A clear communicator. You can explain technical findings to both security specialists and non-technical colleagues, and you document your work so others can build on it.
* Fluent in English and eager to contribute in a multicultural and international environment.

What we offer
Compensation:

We offer
a competitive base salary, as well as the opportunity to receive a variable bonus and company equity. The typical base salary for this role ranges between €35.000 and €50.000, based on experience. As you gain experience and make more significant contributions to the business, your compensation will be reviewed to match your impact. Employment terms are governed by the CCNL Commercio, the Italian National Collective Bargaining Agreement for the Commerce, Distribution and Services sector.Learning: When our people grow, we grow with them. That’s why we give every team member a dedicated learning budget to invest in books, courses, conferences, or anything else that fuels their cur