Ingénieur sécurité détection et réponse à incident
Core
Detect, analyze, investigate, and contribute to the handling of cybersecurity events and incidents using EDR alerts and security data sources.
Role type
Senior Incident Response Analyst (SOC/CSIRT)
Builds
Operational cybersecurity monitoring and incident response capabilities for a large public organization
Domain
Cybersecurity, Incident Response, SOC Operations
Required skills
EDR/XDR investigation, SIEM with query language (SPL), MITRE ATT&CK framework, Windows/Linux systems, TCP/IP/DNS/HTTP(S), Active Directory, authentication mechanisms (Kerberos, NTLM, OAuth2, OIDC, SAML), Threat Hunting, cloud platforms (Entra ID, M365, Azure)
Preferred skills
SOAR mechanisms, PowerShell scripting, Python, forensic tools
Technologies
EDR, XDR, SIEM, MITRE ATT&CK, Entra ID, M365, Azure, PowerShell, Python
Responsibilities
Monitor security events and investigate alerts; Analyze detection coverage and tune rules based on incidents and attack techniques; Evaluate telemetry quality and identify visibility gaps; Qualify incidents, define scope, contain threats, collect evidence, and support eradication; Coordinate technical investigations with external SOC and internal teams
Seniority
Senior, hands-on IC