Ingénieur sécurité détection et réponse à incident
Core
Detect, analyze, investigate, and contribute to the handling of cybersecurity events and incidents using EDR alerts and security data sources.
Role type
Senior Incident Response Analyst (SOC/CSIRT)
Builds
Operational cybersecurity monitoring and incident response capabilities for a large public organization.
Domain
Cybersecurity, Incident Response, SOC
Deliverable
client delivery
Required skills
EDR/XDR investigation, SIEM with query language (SPL), MITRE ATT&CK framework, Windows/Linux systems, TCP/IP/DNS/HTTP, Active Directory, authentication mechanisms (Kerberos, NTLM, OAuth2, OIDC, SAML), Threat Hunting, cloud platforms (Entra ID, M365, Azure)
Preferred skills
SOAR mechanisms, PowerShell/Python scripting, forensic tools
Responsibilities
Monitor security events and investigate alerts; Analyze detection coverage and tune rules based on incidents and MITRE ATT&CK; Evaluate telemetry quality and identify visibility gaps; Qualify incidents, define scope, contain, collect evidence, support eradication, and document lessons learned; Translate technical alerts into situational understanding; Coordinate investigations with external SOC and internal teams.
