Cybersecurity Incident Response Lead
Pubblicato il 25-09-2026 - Fineco Bank in Turbigo
Fineco Bank is a leading European bank with 20 years of history and a fully digital, branchless approach. We offer a wide range of products including trading, investment and payment services, a proprietary trading/investment platform, and banking solutions for domestic and international demand.
Position
We are looking for a Cybersecurity Incident Response Lead to join the ICT & Cybersecurity department. This role heads the end‑to‑end IR program, leads incident response coordination, and provides clear status to management. The lead works closely with SOC, technical teams, and governance functions, orchestrating contributions from teams not directly reporting to Cybersecurity.
The role is not SOC shift management nor purely forensic or compliance. The focus is coordinating incident response, maturing the IR program, orchestrating involved technical teams, and turning cyber events into operational decisions, manager communication, and audit‑ready evidence.
Principali Attività
- Guide operational coordination of security incident response: triage, containment priority,
reconstruct initial vector, kill chain, propagation, blast radius, and coordination of eradication and recovery with owner teams.
- Maintain an operational timeline and structured decision log during incidents, tracking hypotheses, containment decisions, owners, available evidence, and residual risks.
- Build, maintain, and test the IR program: playbook, runbook, escalation procedures, roles and responsibilities, incident classification criteria, and continuous improvement mechanisms.
- Contribute to the evolution of detection and response capabilities, defining requirements with the SOC based on real incidents, tabletop exercises, threat intelligence, and improving SIEM/SOAR/EDR/XDR workflows.
- Integrate threat intelligence into the IR cycle: translate indicators of compromise, TTPs and threat scenarios into concrete detection, hunting, containment, and hardening actions.
- Conduct structured post‑