ICT Security Officer

Trigyn has a contractual opportunity for an ICT Security Officer – Cloud Computing Support. The Cloud Computing Support – Expert Support (ICT Security Officer) will provide highly specialized ICT security services in support of the client, covering the ICT environment and systems defined in the overarching Service Level Agreement (SLA) between client and the Office, including the management of a dedicated Microsoft 365 tenant. The position will either be based in Valencia, Spain or Brindisi, Italy within the client, and deliver remote security services for the covered environment. Services shall be provided in accordance with applicable ICT governance, standards, and security policies, commensurate with the available capacity to ensure reasonable service coverage (5x8 during defined

working hours
), complemented by a duty officer modality outside

working hours
under specifically defined conditions to support and respond to urgent security-specific needs, including incident response. Expert Support level: the incumbent shall possess extensive relevant professional experience requiring specialized technical knowledge and skills. Expected outputs at this level include, inter alia, highly specialized technical security support and project-wide proposals. Cloud & Collaboration Environment Microsoft 365 tenant: Exchange Online, SharePoint Online, OneDrive, Teams, and associated collaboration workloads. Microsoft Entra ID (Azure AD): identities, authentication, conditional access, and privileged accounts within the covered tenant. Microsoft Defender XDR suite: Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps, and Defender for Identity, as deployed. Microsoft Purview and related compliance, audit, and data-protection capabilities, as applicable. Security Monitoring & Response Systems Designated ICT security systems and services generating security reports and alerts for the covered environment. Vulnerability identification and assessment capabilities applicable to the covered ICT environment and systems. Operational Resilience (OR) controls implemented and maintained by relevant operations teams across the covered ICT environment and systems. Microsoft 365 & Cloud Security In-depth expertise in Microsoft 365 security administration: Microsoft Defender XDR, Defender for Office 365 (anti-phishing, safe links/attachments, mail-flow protection), and Defender for Endpoint. Microsoft Entra ID security: identity protection, risky sign-in/user investigation, conditional access design, MFA enforcement, and privileged identity management. Investigation and remediation of compromised accounts, suspicious e-mails, business e-mail compromise (BEC), and other cloud-borne threats. Microsoft Sentinel or equivalent cloud SIEM/SOAR platforms: analytics rules, incident triage, automation/playbooks, and watchlists. Security Operations & Incident Response Security incident response methodologies aligned with recognized frameworks (e.g., Digital forensics analysis: evidence collection and preservation, log and artifact analysis, and root-cause determination for cloud and hybrid environments. Threat intelligence handling: collection, analysis, sharing, and coordination of recommended mitigation measures (e.g., Security assessment of ICT environments and systems throughout their life cycle, including configuration reviews against security baselines and benchmarks (e.g., CIS, Microsoft Secure Score). Preparation of security advisories, notifications, and remediation recommendations referencing relevant security updates. Security architecture and configuration-baseline advisory for system design, development, and modification in alignment with applicable architectural standards and security policies. Development of security guidelines, standards, and policy inputs with organization-wide impact, consistent with the Expert Support level. Preparation of end-user security awareness materials and support to awareness campaigns. Security reporting within established governance and reporting frameworks, including incident and status reporting. Operational Resilience (OR) controls implemented and maintained by relevant operations teams across the covered ICT environment and systems. Monitor, verify, and escalate security reports and alerts generated by designated ICT security systems and services. Monitor and respond to Microsoft 365 security incidents, including compromised accounts, suspicious e-mails, and other threats affecting the tenant. Conduct proactive threat-hunting activities using environment-specific capabilities, including M365 security tools and other relevant technologies, as appropriate. Establish, document, and maintain methods, procedures, and tools appropriate to the environment to support threat detection and response. Perform security incident response activities, including forensics analysis, and coordinate and advise on appropriate response measures for incidents detected by the team or reported/escalat