Junior SOC Analyst

Junior SOC AnalystCompany descriptionBU Creative runs a Managed Detection and Response (MDR) service built on buMDR, our in-house SOC and NIS2 compliance platform. We monitor endpoints, networks, web applications and cloud environments for our clients. When something happens we detect it, investigate it, contain it and explain it to the client. We are a small, hands-on team: you will work on real incidents from your first weeks, alongside the people who build the platform.Role descriptionWe are looking for a Junior SOC Analyst who is curious, wants to learn quickly and is motivated by catching real attackers. You will join our Security Operations Center and grow into a full analyst role.Triage and investigate alerts and incidents across endpoints (Windows, Linux, macOS), network sensors, web application logs and Microsoft 365Tell true positives from false positives, document your reasoning and escalate or close cases with clear evidenceReconstruct attack chains and map attacker activity to MITRE ATT&CKRun threat hunts and IOC sweeps across the client fleetSupport containment actions such as IP blocking, host isolation and account lockdown, following our playbooksWrite clear incident reports and notifications for clients, in Italian and EnglishHelp tune detection rules and give feedback that improves the platformTake part in the night shift and on-call rotation, so incidents get handled around the clockTravel to client sites for onboarding, sensor and agent deployment, incident response and meetingsQualificationsMust haveVery good understanding of networking: TCP/IP, routing, VLANs, NAT, DNS, HTTP/HTTPS, TLS, VPNs, firewalls and proxiesSolid foundations in information security: authentication, access control, encryption basics, logging, and common vulnerabilities and misconfigurationsWorking knowledge of the most common attack techniques and how they look in logs: phishing and credential theft, brute force and credential stuffing, account takeover, web application attacks (OWASP Top 10: SQL injection, IDOR, path traversal, webshell upload), exploitation of public-facing services, privilege escalation, lateral movement, persistence, command and control, living-off-the-land tools such as PowerShell, data exfiltration and ransomwareGood written and spoken EnglishWillingness to work night shifts or be on callWillingness to travelFluent ItalianNice to haveFamiliarity with MITRE ATT&CK and the cyber kill chainExperience reading Windows Event Logs, Linux logs and web server access logsHands-on experience with SIEM, EDR, IDS/NDR tools (for example Suricata or Zeek) or packet analysis with WiresharkScripting in Python, Bash or PowerShell, and basic SQLParticipation in CTFs, home labs, or offensive security platforms such as Hack The Box or TryHackMeAwareness of the NIS2 Directive and incident notification requirements