Portobello

• Technical owner of the information security operations platform, responsible for the architecture, strategy, and maintenance of detection controls, incident response, vulnerability management, identity management, and perimeter governance. • Primary technical reference for the area, contributing to the evolution of process maturity and the technical development of the team.

• Execute the Vulnerability Management lifecycle: analyze scan results, prioritize based on risk, and coordinate and track remediation with the responsible teams (Infrastructure, Systems, etc.). • Maintain, update and improve operational indicators and remediation workbooks (agent coverage, severity, monitoring of remediation SLAs). • Operate Identity and Access Management (IAM) processes: provisioning, deprovisioning, privilege granting, periodic access reviews and support for MFA mechanisms. • Actively support corporate access review campaigns and validation of segregation of duties (SoD). • Monitor, classify and investigate alerts generated by the security tools within your scope. • Perform initial triage and analysis of security incidents, escalating to a Specialist when necessary. • Produce periodic operational reports and security metrics for your area of responsibility. • Prepare and keep technical documentation and Standard Operating Procedures (SOPs) up to date.

• Operate and support the maintenance of the SIEM platform, ensuring correct collection of log sources, and the integrity and quality of received data. • Support the creation, review and fine-tuning of detection rules and use cases to reduce false positives and optimize alerts. • Operate and administer Next-Generation Firewalls (NGFW): controlled implementation of access rules, NAT, VPNs, justification documentation, and periodic review of orphaned rules. • Actively support network segmentation activities, traffic rules, and perimeter hardening. • Monitor, classify and investigate security alerts generated by the SIEM, firewalls and other perimeter tools. • Perform triage and initial analysis of perimeter security incidents, carrying out structured escalation to a Specialist when necessary. • Produce operational reports, traffic maps and indicators of security incidents/blocks. • Create and keep up-to-date technical documentation of topologies, network flows and operational procedures (SOPs).