Cyber Security Offensive - Senior Specialist (IT/OT)

MSC Cruises; Napoli; Hybrid; EUR 38,000 - 42,000; Full time

Benefits offered by this job

Meal vouchers

Health Insurance

Flexible working hours

Employee Assistance Programme

Job summary

MSC Cruises is seeking a Cyber Security Offensive Senior Specialist (IT/OT) based in Naples. You will independently execute complex IT offensive activities, including penetration tests on infrastructure, AD, cloud, web apps and APIs, and support adversary emulation and red/purple team exercises across IT and OT environments.

You will deliver technical reports with actionable remediation guidance, coordinate OT testing with engineering teams, and liaise with suppliers and stakeholders to drive

Qualifications

• Five to eight years of hands-on offensive cyber security experience.
• Experience with penetration testing, red/blue teams or security validation in enterprise or consulting environments.
• Proficiency with cloud solutions (Azure, AWS), networking, Active Directory, web apps and APIs.
• Knowledge of MITRE ATT&CK (Enterprise and ICS), OWASP, CVSS, CIS Controls; basic IEC 62443 and NIST SP 800-82 awareness.
• Exposure to OT/ICS, SCADA and maritime tech is a plus.
• Scripting to automate testing tasks (Python, PowerShell, Bash).

Responsibilities

• Support the execution of the offensive security plan in line with cyber strategy, risk appetite and standards.
• Apply offensive testing methodologies and rules of engagement; document lessons learned.
• Execute complex IT offensive activities including penetration tests on infrastructure, AD, cloud, web apps and APIs; support adversary emulation and red/purple team exercises.
• Perform IT technical rechecks to confirm remediation and provide evidence to close findings.
• Support OT offensive assessments delivered by third parties: contribute to scoping and on-site review of deliverables.
• Coordinate test windows and logistics with OT teams to ensure safe OT testing with minimal impact.
• Deliver clear technical reports with risk ratings and remediation guidance; review third-party offensive reports.
• Follow up remediation with system owners and track progress in ticketing systems.

Skills

Penetration testing

Red team

Purple team

Adversary emulation

Attack surface management

Security validation

Cloud platforms

Threat assessment

Burglar Suite knowledge

Python

PowerShell

Bash

Education

Degree in cyber security

Tools

Burp Suite

Nmap

Metasploit

BloodHound

Impacket

Python

PowerShell

Bash

Job description

Job Purpose

MSC Cruises is recruiting a Cyber Security Offensive Senior Specialist (IT/OT), based in Naples, to join its Cyber Security department. The role requires experienced hands‑on offensive security expertise to execute and support complex offensive security activities across IT and OT environments, including penetration testing, red and purple team exercises, adversary emulation, attack surface management and security validation.

Job Purpose

MSC Cruises is recruiting a Cyber Security Offensive Senior Specialist (IT/OT), based in Naples, to join its Cyber Security department. The role requires experienced hands‑on offensive security expertise to execute and support complex offensive security activities across IT and OT environments, including penetration testing, red and purple team exercises, adversary emulation, attack surface management and security validation. The Senior Specialist independently executes complex IT offensive activities, carrying out penetration tests and technical rechecks to verify remediation. For OT environments across ships, terminals and operational facilities, the role supports specialized third‑party assessments, contributing to scoping, on‑site coordination and the technical review of deliverables. Working with security architects, Cyber Defense and SOC teams, the role provides specialist advice and follows up vulnerabilities with system owners through to verified closure.

Key Accountabilities

• Support the execution of the offensive security plan in line with cyber strategy, risk appetite, policies and standards, and advise on practical improvements based on the evolving threat landscape.
• Apply established offensive testing methodologies, standards and rules of engagement, document lessons learned, share specialist knowledge with colleagues and support junior team members.
• Execute complex IT offensive activities with autonomy, including penetration tests on infrastructure, Active Directory, cloud, web applications, APIs and wireless, and support adversary emulation and red and purple team exercises.
• Perform IT technical rechecks to confirm remediation and provide evidence to close findings.
• Support shipboard and terminal OT offensive assessments delivered by third parties: contribute to scoping and rules of engagement, follow execution on site and perform the first technical review of deliverables.
• Contribute to safe OT testing with minimal operational impact, coordinating test windows and logistics with OT Engineering, Marine Operations, Terminal Operations and Infrastructure teams.
• Deliver clear technical reports with accurate risk ratings and actionable remediation guidance, and advise on the technical quality of third‑party offensive reports.
• Follow up remediation of offensive security findings with system owners, tracking progress against severity‑based service levels in the vulnerability management and ticketing platforms.

QUALIFICATIONS (skills, Competencies, Experience)

• Degree in cyber security, computer science, engineering or a related discipline.
• 5–8 years of hands‑on experience in offensive cyber security, including penetration testing, red teaming or security validation, in enterprise or consulting environments.
• Solid hands‑on capability in penetration testing, technical rechecks, exploit validation and attack path analysis; exposure to vulnerability research and external attack surface management is appreciated.
• Good understanding of cloud solutions (e.g. Azure, AWS), networking, Active Directory, web applications and APIs, containers and IAM from an attacker perspective.
• Knowledge of offensive and assurance frameworks such as MITRE ATT&CK (Enterprise and **ICS**), OWASP, CVSS and CIS Controls, with basic knowledge of IEC 62443 and NIST SP 800-82.
• Exposure to OT/ICS, SCADA, industrial protocols or maritime technology, and awareness of safe OT testing practices, is a plus.
• Proficiency with common offensive tools (e.g. Burp Suite, Nmap, Metasploit, BloodHound, Impacket) and ability to write scripts (e.g. Python, PowerShell, Bash) to automate testing tasks.
• Ability to work with technical owners on vulnerability remediation, using vulnerability management and ticketing platforms such as ServiceNow.
• Based in Naples, available to travel to vessels, terminals and MSC sites for assessment activities; Italian and fluent English required (30% time travelling).
• Offensive‑minded professional with strong critical thinking, attention to detail and clear written and verbal communication with suppliers, system owners and technical stakeholders.
• Able to execute multiple complex engagements and priorities autonomously, escalating material risks and decisions when required in a fast‑paced international environment.
• OSCP or an equivalent hands‑on certification (e.g. PNPT, GPEN, CRTP) is preferred; OSWE, CRTO or GICSP are an advantage.

Visa Requirements

• Right to work in Italy

What We Offer

In compliance with the applicable pay transparency legislation, the following information is provided regarding the initial compensation foreseen for the position.

Contract

• Type of contract: Permanent
• Hybrid working model: 2 days per week remotely
• Applicable Collective Labour Agreement (CCNL): “Addetti agli uffici ed ai terminals delle società di navigazione che esercitano l’armamento privato” – sez. personale di terra
• Gross annual salary (RAL): between €38.000 – €42.000 gross per year, paid over 14 monthly installments
• Meal vouchers: worth €8 per on‑site working day

The offer in terms of salary will be determined based on the candidate’s professional experience, technical competencies, and the level of autonomy and responsibility assigned to the role.

Welfare&Wellbeing

We offer a range of Welfare&Wellbeing Initiatives as well as benefits including Productivity award, Health Insurance, Learning opportunities, flexible working hours, Employee Assistance Programme, Discounts & Partnerships within the MSC group.

Our commitment

We are committed to building a future that values diverse perspectives, embraces the world beyond borders, and fosters an inclusive environment where every individual feels valued, respected and empowered to be their authentic selves. Our commitment extends to taking meaningful, measurable actions that have a long‑term positive impact on our guests, our employees and our planet.