As an Information Security Analyst at Domyn, you will be the core operational layer of our security monitoring capability: triaging alerts, investigating security events, and building our SIEM function from the ground up on Microsoft Sentinel. You will extend that visibility across perimeter controls, modern cloud-native infrastructure, and emerging AI-driven attack patterns — working closely with security engineering, DevOps, and governance to keep detection and response continuously improving.
Key responsibilities
• Monitor network and cloud environments for security events, triaging and investigating alerts across SIEM, EDR, and cloud-native logging sources.
• Design, build, and operate a SIEM capability from zero — log source onboarding, workspace and architecture design, correlation and detection rules, use case development — primarily on Microsoft Sentinel; experience with other SIEM platforms (Splunk, QRadar, Elastic, etc.) is a plus.
• Own the full security event lifecycle: detection, triage, investigation, escalation, and remediation tracking.
• Configure and tune perimeter and network security controls — IDS/IPS, Web Application Firewalls (WAF), and next-generation firewalls — and validate their effectiveness against current attack techniques.
• Apply monitoring and detection practices to modern cloud-native and hybrid infrastructure (Azure primarily), including container/Kubernetes environments, IaaS/PaaS logging, and identity-centric attack surfaces.
• Track and analyze AI-related attack patterns on both fronts: attacks that leverage AI (AI-assisted phishing, automated recon, adversarial techniques) and attacks against AI systems (prompt injection, model/data poisoning, jailbreaking).
• Apply the OWASP Top 10 for web applications and the OWASP Top 10 for LLM/GenAI Applications to assess and harden AI-integrated systems.
• Contribute detection use cases, playbooks, and runbooks to continuously mature the security monitoring function.
• Collabora
📌 Information Security Analyst (Milano)
🏢 Domyn
📍 Milano