Job purposeto strengthen the organisation's ability to detect cyber threats, reduce security exposure and respond effectively to incidents by autonomously executing complex investigations, security automation, exposure validation and threat intelligence activities in cortex xsiam and the microsoft security stack.key accountabilitiesexecute end-to-end investigations of complex alerts and incidents in cortex xsiam, applying triage procedures and advising on high-impact cases.investigate and troubleshoot microsoft defender xdr findings across endpoint, email, identity and cloud applications, correlating evidence with soc investigations.apply threat intelligence to investigations and exposure checks, support incident response, and deliver post-incident improvement actions.develop, test and maintain advanced kql hunting queries, custom detections and soar playbooks, tuning them to improve fidelity and reduce false positives.use python, rest apis, json and git to deliver and maintain security data processing and integrations across cortex and microsoft defender workflows.perform external attack surface monitoring, exposure validation, risk-based prioritisation and support remediation tracking.conduct breach and attack simulation activities, document control gaps and advise on detection,



prevention and response improvements.apply approved llm tools to support investigation summaries, threat-intelligence analysis and scripting, ensuring data protection and required approvals.support junior colleagues through technical guidance, peer review of queries and playbooks, and maintain runbooks, procedures and operational reporting.qualifications5-8 years of experience in cybersecurity operations, detection engineering or incident response, with solid experience in siem, edr/xdr, alert triage and incident escalation.hands-on experience with the microsoft security stack, microsoft defender xdr, intermediate-advanced kql and python, and rest apis/json/git.ability to operate autonomously in cortex xsiam; experience with cortex xsoar or comparable soar platforms is a plus.italian (mandatory) and english (upper-intermediate to advanced) for daily communication and technical discussions.relevant degree or equivalent practical experience; security certifications such as microsoft sc-200, giac gcih, gcia are a plus.analytical thinking, clear technical documentation, autonomy on complex activities and effective communication with global teams.

📌 Cyber resilience senior specialist (Napoli)
🏢 Msc Cruises
📍 Napoli