30 ott - Torino
Business Unit Creative
Junior SOC Analyst
Company description
BU Creative runs a Managed Detection and Response (MDR) service built on buMDR, our in-house SOC and NIS2 compliance platform. We monitor endpoints, networks, web applications and cloud environments for our clients. When something happens we detect it, investigate it, contain it and explain it to the client. We are a small, hands-on team: you will work on real incidents from your first weeks, alongside the people who build the platform.
Role description
We are looking for a Junior SOC Analyst who is curious, wants to learn quickly and is motivated by catching real attackers. You will join our Security Operations Center and grow into a full analyst role.
- Triage and investigate alerts and incidents across endpoints (Windows, Linux, macOS), network sensors, web application logs and Microsoft 365
- Tell true positives from false positives, document your reasoning and escalate or close cases with clear evidence
- Reconstruct attack chains and map attacker activity to MITRE ATT&CK;
- Run threat hunts and IOC sweeps across the client fleet
- Support containment actions such as IP blocking, host isolation and account lockdown, following our playbooks
- Write clear incident reports and notifications for clients, in Italian and English
- Help tune detection rules and give feedback that improves the platform
- Take part in the night shift and on-call rotation, so incidents get handled around the clock
- Travel to client sites for onboarding,
sensor and agent deployment, incident response and meetings
Qualifications
Must have
- Very good understanding of networking: TCP/IP, routing, VLANs, NAT, DNS, HTTP/HTTPS, TLS, VPNs, firewalls and proxies
- Solid foundations in information security: authentication, access control, encryption basics, logging, and common vulnerabilities and misconfigurations
- Working knowledge of the most common attack techniques and how they look in logs: phishing and credential theft, brute force and credential stuffing, account takeover, web application attacks (OWASP Top 10: SQL injection, IDOR, path traversal, webshell upload), exploitation of public-facing services, privilege escalation, lateral movement, persistence, command and control, living-off-the-land tools such as PowerShell, data exfiltration and ransomware
- Good written and spoken English
- Willingness to work night shifts or be on call
- Willingness to travel
- Fluent Italian
Nice to have
- Familiarity with MITRE ATT&CK; and the cyber kill chain
- Experience reading Windows Event Logs, Linux logs and web server access logs
- Hands-on experience with SIEM, EDR, IDS/NDR tools (for example Suricata or Zeek) or packet analysis with Wireshark
- Scripting in Python, Bash or PowerShell, and basic SQL
- Participation in CTFs, home labs, or offensive security platforms such as Hack The Box or TryHackMe
- Awareness of the NIS2 Directive and incident notification requirements