• Identify, assess and mitigate cyber risks and vulnerabilities, ensuring protection of the company’s assets • Manage the SIEM platform by creating, tuning and improving correlation rules and use cases, and defining severity and criticality levels for prioritization and response • Ingest new data sources into the SIEM, including maintenance, normalization/parsing of logs and integrations with internal and external systems • Perform and oversee continuous monitoring of security events and incidents using SIEM, SOAR, EDR/XDR and related solutions • Conduct threat hunting activities to proactively identify suspicious behavior and threats • Work with Threat Intelligence (production and consumption of CTI), integrate with TIPs (such as MISP), and automate IOCs • Lead investigations and incident response efforts for cyber incidents, proposing corrective and preventive actions • Create and review operational documentation and incident response playbooks/flows • Support and follow up on security tests (penetration tests) and track remediation plans • Ensure compliance with standards and regulations (PCI-DSS, ISO 27001, SOC 2, Central Bank regulations), supporting internal and external audits • Produce technical and management reports on security status and incidents handled, recommending continuous improvements • Support and participate in incident simulation exercises: tabletop, red team, blue team and purple team • Drive continuous improvement of SOC processes, workflows and maturity • Collaborate with internal teams on the ongoing evolution of information security practices • Mentor and train team members, promoting information security best practices

• Walk us through your end-to-end process for evaluating security software. • Detail the specific steps and stakeholders involved in a recent SIEM or SecOps purchase. • Describe the challenges you face when comparing different security vendors. • Provide feedback on what makes a vendor evaluation successful for your organization.

• Monitor and respond to security alerts from Microsoft Sentinel, Microsoft Defender XDR, ZeroFox, and Entra ID related activity • Perform initial triage of alerts to determine severity, scope, and whether activity is malicious or a false positive • Conduct basic investigations using available telemetry from Azure, Endpoint, Office, etc • Utilize Kusto Query Language (KQL) to query logs and validate suspicious activity when required • Escalate validated or high-risk alerts to Tier 2 analysts with clear documentation, supporting evidence, and timelines • Follow established SOC playbooks and SOP during alert handling and investigations • Document all investigations and actions taken in the case management system (ServiceNow) with accuracy and clarity • Track and identify recurring alerts or patterns in the environment and report findings to support detection tuning efforts • Support incident response efforts by collecting relevant artifacts and assisting Tier 2 in identifying potential root cause • Provide feedback on SOC processes, playbooks, and workflows to improve operational efficiency • Assist with projects and ongoing efforts to create documentation, support automation initiatives, and review legacy SOC processes • Ensure timely response and adherence to SLAs for alert acknowledgment, triage, and escalation • Assist Compliance teams with audit requests by retrieving and organizing relevant security log data from Sentinel

• Overseeing and managing the organization’s cyber incident response and operational security activities • Directing response strategies, guiding investigations, and coordinating remediation efforts • Collaborating with cross-functional teams to protect the organization from cyber threats • Developing and implementing effective incident response plans