Cyber Security Resilience Senior Specialist

JOB PURPOSE

To strengthen the organization's ability to detect cyber threats, reduce security exposure and respond effectively to incidents by autonomously executing complex investigations, security automation, exposure validation and threat intelligence activities in Cortex XSIAM and the Microsoft security stack, within the priorities agreed with the Local Cyber Resilience Team Lead.

KEY ACCOUNTABILITIES

• Execute end-to-end investigations of complex alerts and incidents in Cortex XSIAM, the primary SOC platform, applying established triage procedures and advising on the handling of high-impact cases.
• Investigate and troubleshoot Microsoft Defender XDR findings across endpoint, email, identity and cloud applications, correlating evidence with SOC investigations and documenting the analysis.
• Apply threat intelligence to investigations and exposure checks, and support incident response as a senior technical contributor, escalating critical incidents through the established approval process and delivering post-incident improvement actions.
• Deliver, test and maintain KQL advanced hunting queries and custom detections, tuning them to improve fidelity and reduce false positives.
• Deliver, test and maintain SOAR playbooks for enrichment, investigation and response, troubleshooting integration issues and advising on the design of new workflows.
• Apply Python, REST APIs, JSON and Git to deliver and maintain security data processing and integrations across Cortex and Microsoft Defender workflows, following the established approval process for production changes.
• Execute external attack surface monitoring and exposure validation, advising on risk-based prioritization and supporting remediation tracking and closure verification.
• Execute breach and attack simulation activities, documenting control gaps and advising on detection, prevention and response improvements.
• Apply organization-approved LLM tools to support investigation summaries, threat intelligence analysis, scripting, detection queries and documentation, validating outputs, protecting sensitive data and obtaining the required approval before operational use.
• Support junior colleagues through technical guidance, peer review of queries and playbooks and knowledge transfer, and maintain runbooks, technical procedures and operational reporting.

QUALIFICATIONS (skills, competencies, experience)

• Indicatively 5-8 years of experience in cybersecurity operations, detection engineering or incident response,including solid experience with SIEM, EDR/XDR, alert triage, complex incident investigation and escalation processes.
• Industry: experience in international, distributed or maritime technology environments is a preferred advantage, not a requirement.
• Italian: mandatory, for effective day-to-day communication. English: upper-intermediate to advanced, written and spoken, sufficient to take part in technical discussions, explain investigation findings, write clear documentation and collaborate with global teams.
• Technical and PC skills: hands-on experience with the Microsoft security stack, including Microsoft Defender XDR; intermediate to advanced KQL and Python, with solid experience of REST APIs, JSON and Git; delivery and maintenance of SOAR playbooks and security integrations; ability to operate autonomously in Cortex XSIAM; practical experience with an EDR/XDR platform such as Microsoft Defender for Endpoint, Cortex XDR, CrowdStrike Falcon, SentinelOne or a comparable solution (experience with every platform is not required); controlled use of LLMs for security tasks, with critical review of outputs and compliance with data handling and tool approval requirements (AI model development experience is not required).
• Preferred, not mandatory: hands-on Cortex XSIAM experience; exposure to Cortex XSOAR or comparable SOAR platforms, Microsoft Sentinel, Microsoft Entra ID security, external attack surface management, breach and attack simulation, or MITRE ATT&CK.
• Education: relevant degree, vocational qualification or equivalent practical experience in cybersecurity, computer science or a related discipline. Preferred, not mandatory: associate or professional-level security certifications such as Microsoft SC-200, GIAC GCIH/GCIA or equivalent.
• Analytical thinking and clear technical documentation of findings, procedures and operational reporting.
• Autonomy on complex activities, with sound prioritization of workload and recognition of when to elevate.
• Specialist advice and support to junior colleagues, including peer review and knowledge transfer.
• Effective communication and collaboration with security operations, detection engineering, infrastructure teams, service providers and global teams.

VISA REQUIREMENTS

• Right to work in