Junior SOC Analyst

Business Unit Creative Srl; Piemonte; Presencial; EUR 28.000 - 42.000; Jornada completa

Descripción de la vacante

Business Unit Creative Srl is seeking a Junior SOC Analyst to join our MDR team built on buMDR. You will work on real incidents from early weeks, alongside the people who build the platform.

You will triage alerts across endpoints, networks, web apps and Microsoft 365, map attacker activity to MITRE ATT&CK, and run threat hunts. You will write clear incident reports in Italian and English and participate in night shifts, with travel to client sites as needed.

Formación

• Strong networking knowledge: TCP/IP, DNS, HTTP/S, VPNs, firewalls.
• Solid information security foundations: authentication, encryption, logging.
• Familiarity with common attack techniques and how they look in logs.

Responsabilidades

• Triage and investigate alerts across endpoints and networks.
• Differentiate true positives from false positives with evidence.
• Reconstruct attack chains and map activity to MITRE ATT&CK.
• Run threat hunts and IOC sweeps on client fleets.
• Support containment actions per playbooks; document incidents.
• Write incident reports in Italian and English; participate in on-call rotation.

Conocimientos

Networking basics

Info security basics

Attack techniques familiarity

English proficiency

Italian fluency

Herramientas

SIEM

EDR

Wireshark

Descripción del empleo

Junior SOC Analyst

Company description

BU Creative runs a Managed Detection and Response (MDR) service built on buMDR, our in-house SOC and NIS2 compliance platform. We monitor endpoints, networks, web applications and cloud environments for our clients. When something happens we detect it, investigate it, contain it and explain it to the client. We are a small, hands‑on team: you will work on real incidents from your first weeks, alongside the people who build the platform.

Role description

We are looking for a Junior SOC Analyst who is curious, wants to learn quickly and is motivated by catching real attackers. You will join our Security Operations Center and grow into a full analyst role.

• Triage and investigate alerts and incidents across endpoints (Windows, Linux, macOS), network sensors, web application logs and Microsoft 365
• Tell true positives from false positives, document your reasoning and eliminate or close cases with clear evidence
• Reconstruct attack chains and map attacker activity to MIT&CK ATT&CK
• Run threat hunts and IOC sweeps across the client fleet
• Support containment actions such as IP blocking, host isolation and account lockdown, following our playbooks
• Write clear incident reports and notifications for clients, in Italian and English
• Help tune detection rules and give feedback that improves the platform
• Take part in the night shift and on‑call rotation, so incidents get handled around the clock
• Travel to client sites for onboarding, sensor and agent deployment, incident response and meetings

Qualifications

Must have

• Very good understanding of networking: TCP/IP, routing, VLANs, NAT, DNS, HTTP/HTTPS, TLS, VPNs, firewalls and proxies
• Solid foundations in information security: authentication, access control, encryption basics, logging, and common vulnerabilities and misconfigurations
• Working knowledge of the most common attack techniques and how they look in logs: phishing and credential theft, brute force and credential stuffing, account takeover, web application attacks (OWASP Top 10: SQL injection, IDOR, path traversal, webshell upload), exploitation of public‑facing services, privilege escalation, lateral movement, persistence, command and control, living‑off‑the‑land tools such as PowerShell, data exfiltration and ransomware
• Good written and spoken English
• Willingness to work night shifts or be on call
• Willingness to travel
• Fluent Italian

Nice to have

• Familiarity with MIT&CK and the cyber kill chain
• Experience reading Windows Event Logs, Linux logs and web server access logs
• Hands‑on experience with SIEM, EDR, IDS/NDR tools (for example Suricata or Zeek) or packet analysis with Wireshark
• Scripting in Python, Bash or PowerShell, and basic SQL
• Participation in CTFs, home labs, or offensive security platforms such as Hack The Box or TryHackMe
• Awareness of the NIS2 Directive and incident notification requirements