Ric
Riccardo is a Defensive Security Engineer II at Satispay, where he works on detection engineering, security monitoring, incident response, and automation across a large-scale fintech environment.
His focus is on building defensive systems that reduce noise, improve visibility, and turn security data into reliable actions a blue team can use every day.
Splunk is a major part of his daily work — he holds both Splunk Enterprise Certified Admin and Core Certified Power User certifications — and he has also worked on projects combining Splunk with machine learning, including DNS anomaly detection.
In 2026, together with the Satispay Security Team, he placed #1 in Italy and #3 in EMEA at Splunk BOTS, competing against 358 teams.
More recently, Riccardo has been exploring how LLMs and agentic systems can move beyond simple assistants and become part of real defensive workflows. His current focus is on Agentic SOAR: combining n8n, Splunk, automated playbooks, and AI-driven decision making while keeping humans, guardrails, and predictable behavior firmly in the loop.
He likes security automation that can actually be run, tested, broken, and improved — preferably in a lab rather than explained through fifty slides.
At RomHack Camp 2026, he’ll bring that approach to the stage with a hands-on workshop on building AI-assisted defensive automation.
Session
Everyone talks about SOAR; few have wired one up end to end. In this hands-on lab you'll build the "respond" half of a real detection-and-response pipeline — no slideware, no vendor console.
We hand you a live AWS environment: an API gateway and WAF fronting a target app, with all traffic and attack detections already flowing into Splunk. Your job is to build the automation that fires when Splunk raises an alert, using n8n (open-source, low-code) as the orchestrator.
You'll answer one question — "should I block this IP?" — with steadily rising intelligence. First, block on any alert (and watch the false positives roll in). Then block only when threat intel says the IP is malicious. Then hand the decision to an AI agent that investigates for itself: it queries multiple intel sources and runs its own Splunk searches, then returns a verdict with its reasoning. Finally, put a human in the loop to approve or overrule the agent — because trusting an autonomous blocker is the real 2026 question — and, time permitting, make the block self-reverse with a TTL and an audit trail back to Splunk.
You'll leave with a working, governed, AI-triaged auto-response pipeline and the patterns to rebuild it at home. Bring a laptop; we bring the infrastructure (AI model included).