Cyber Security Resilience Senior Specialist

MSC Cruises; Napoli; Hybrid; EUR 35,000 - 42,000; Full time

Benefits offered by this job

Meal vouchers

Health Insurance

Productivity award

Learning opportunities

Flexible working hours

Job summary

MSC Cruises is seeking a senior cybersecurity investigator to strengthen threat detection and response across Cortex XSIAM and Microsoft Defender XDR. You will develop advanced queries, build SOAR playbooks, and apply threat intelligence while coordinating with global teams.

The role requires Italian language fluency and strong English, with hybrid work and a gross annual salary in the 35k–42k EUR range, paid in 14 installments. Experience in maritime tech environments is advantageous.

Qualifications

• 5-8 years in cybersecurity operations, detection engineering or incident response.
• Experience with SIEM/EDR/XDR, alert triage and complex investigations.
• Italian language is mandatory; English must be upper-intermediate or higher.
• Strong knowledge of Python, REST APIs, JSON, and Git.

Responsibilities

• Lead end-to-end investigations in Cortex XSIAM and Microsoft Defender XDR.
• Develop and tune KQL queries and SOAR playbooks for automation.
• Apply threat intelligence and support incident response with senior guidance.
• Produce technically clear investigation summaries and documentation.
• Collaborate with global teams and mentor junior colleagues.

Skills

Cybersecurity operations

Incident response

SIEM/EDR/XDR

KQL

Python

REST APIs

JSON

Git

Investigation documentation

Autonomy on complex activities

Education

Bachelor's degree in cybersecurity or related

Tools

Cortex XSIAM

Microsoft Defender XDR

Cortex XSOAR (SOAR)

Microsoft Sentinel

CrowdStrike Falcon

EDR/XDR platforms

REST APIs

Job description

JOB PURPOSE

To strengthen the organization's ability to detect cyber threats, reduce security exposure and respond effectively to incidents by autonomously executing complex investigations, security automation, exposure validation and threat intelligence activities in Cortex XSIAM and the Microsoft security stack, within the priorities agreed with the Local Cyber Resilience Team Lead.

KEY ACCOUNTABILITIES

• Execute end-to-end investigations of complex alerts and incidents in Cortex XSIAM, the primary SOC platform, applying established triage procedures and advising on the handling of high-impact cases.
• Investigate and troubleshoot Microsoft Defender XDR findings across endpoint, email, identity and cloud applications, correlating evidence with SOC investigations and documenting the analysis.
• Apply threat intelligence to investigations and exposure checks, and support incident response as a senior technical contributor, escalating critical incidents through the established approval process and delivering post-incident improvement actions.
• Deliver, test and maintain KQL advanced hunting queries and custom detections, tuning them to improve fidelity and reduce false positives.
• Deliver, test and maintain SOAR playbooks for enrichment, investigation and response, troubleshooting integration issues and advising on the design of new workflows.
• Apply Python, REST APIs, JSON and Git to deliver and maintain security data processing and integrations across Cortex and Microsoft Defender workflows, following the established approval process for production changes.
• Execute external attack surface monitoring and exposure validation, advising on risk-based prioritization and supporting remediation tracking and closure verification.
• Execute breach and attack simulation activities, documenting control gaps and advising on detection, prevention and response improvements.
• Apply organization-approved LLM tools to support investigation summaries, threat intelligence analysis, scripting, detection queries and documentation, validating outputs, protecting sensitive data and obtaining the required approval before operational use.
• Support junior colleagues through technical guidance, peer review of queries and playbooks and knowledge transfer, and maintain runbooks, technical procedures and operational reporting.

QUALIFICATIONS (skills, competencies, experience)

• Indicatively 5-8 years of experience in cybersecurity operations, detection engineering or incident response,including solid experience with SIEM, EDR/XDR, alert triage, complex incident investigation and escalation processes.
• Industry: experience in international, distributed or maritime technology environments is a preferred advantage, not a requirement.
• Italian: mandatory, for effective day-to-day communication. English: upper-intermediate to advanced, written and spoken, sufficient to take part in technical discussions, explain investigation findings, write clear documentation and collaborate with global teams.
• Technical and PC skills: hands-on experience with the Microsoft security stack, including Microsoft Defender XDR; intermediate to advanced KQL and Python, with solid experience of REST APIs, JSON and Git; delivery and maintenance of SOAR playbooks and security integrations; ability to operate autonomously in Cortex XSIAM; practical experience with an EDR/XDR platform such as Microsoft Defender for Endpoint, Cortex XDR, CrowdStrike Falcon, SentinelOne or a comparable solution (experience with every platform is not required); controlled use of LLMs for security tasks, with critical review of outputs and compliance with data handling and tool approval requirements (AI model development experience is not required).
• Preferred, not mandatory: hands-on Cortex XSIAM experience; exposure to Cortex XSOAR or comparable SOAR platforms, Microsoft Sentinel, Microsoft Entra ID security, external attack surface management, breach and attack simulation, or MITRE ATT&CK.
• Education: relevant degree, vocational qualification or equivalent practical experience in cybersecurity, computer science or a related discipline. Preferred, not mandatory: associate or professional-level security certifications such as Microsoft SC-200, GIAC GCIH/GCIA or equivalent.
• Analytical thinking and clear technical documentation of findings, procedures and operational reporting.
• Autonomy on complex activities, with sound prioritization of workload and recognition of when to elevate.
• Specialist advice and support to junior colleagues, including peer review and knowledge transfer.
• Effective communication and collaboration with security operations, detection engineering, infrastructure teams, service providers and global teams.

VISA REQUIREMENTS

• Right to work in Italy.

WHAT WE OFFER

In compliance with the applicable pay transparency legislation, the following information is provided regarding the initial compensation foreseen for the position.

Contract

• Type of contract: Permanent
• Hybrid working model: 2 days per week remotely
• Applicable Collective Labour Agreement (CCNL): "Addetti agli uffici ed ai terminals delle società di navigazione che esercitano l'armamento privato" - sez. personale di terra
• Gross annual salary (RAL): between €35.000 - €42.000 gross per year, paid over 14 monthly installments
• Meal vouchers: worth €8 per on-site working day

The offer in terms of salary will be determined based on the candidate's professional experience, technical competencies, and the level of autonomy and responsibility assigned to the role.

Welfare&Wellbeing

We offer a range of Welfare&Wellbeing Initiatives as well as benefits including Productivity award, Health Insurance, Learning opportunities, flexible working hours, Employee Assistance Programme, Discounts & Partner

Our commitment

We are committed to building a future that values diverse perspectives, embraces the world beyond borders, and fosters an inclusive environment where every individual feels valued, respected and empowered to be their authentic selves. Our commitment extends to taking meaningful, measurable actions that have a long-term positive impact on our guests, our employees and our planet.