2 SOC Analysts N2 / N3 – Cyber, Incident Response & Threat Hunting @ Marseille

Project overview

Mission freelance | Cyber Defense Center (CDC) | SOC / Blue Team

Context and challenges

In a context of increasing and sophisticated cyber threats, a large international group is looking for SOC Analysts levels 2 and 3 to strengthen its Cyber Defense Center (CDC).

The objective is to ensure effective threat detection, in-depth investigation of security events, and rapid, coordinated response to cyber incidents.

You will join a dynamic cybersecurity team, equipped with advanced security solutions, and will directly contribute to the protection of the group's information systems.

The mission covers two complementary levels of expertise:

The SOC environment operates 24/7 in a Follow the Sun mode, explicitly planned for the L2 scope.

Detailed missions

SOC L2 Scope

SOC L3 Scope

SOC L2

SOC L3

For the L3 level, these responsibilities also include the preparation, organization, and execution of advanced Threat Hunting exercises, as well as the use of advanced threat intelligence.

The L2 level notably participates in use case tuning, while the L3 level is involved in their development and continuous improvement.

Organization and reporting lines:

The responsibilities presented are not exhaustive and may evolve according to operational needs.

Technical stack and security environment

Technologies, tools, and repositories mentioned in the initial requirements. No specific vendor or product is imposed.

Domain

Technologies and skills

Supervision and orchestration

SIEM, SOAR

Event analysis

System Logs (Host Logs), network logs, security logs from equipment

Network security

Firewalls, IDS, IPS, perimeter defense

Endpoint security

Endpoint Management, security event analysis

Data security

Data Leak Prevention (DLP)

Email security

Email Security Gateway, analysis of suspicious and malicious files

Threat Intelligence

CTI, threat analysis, Threat Hunting

Attack frameworks

MITRE ATT&CK, Cyber Kill Chain

Incident Response

Investigation, incident response, playbooks, simulations

Operational management

SOC Use Cases, SOP, security metrics, reporting

Development / scripting

Python appreciated for L2 level

Candidates must master the main attack vectors across different technical layers, as well as the methods used by attackers to identify vulnerabilities, gain unauthorized access, escalate privileges, and access restricted information.

• SOC Analyst L2: operational investigation, alert qualification, incident response, Threat Hunting, and continuous improvement of detection systems.
• SOC Analyst L3: advanced technical expertise, investigation of complex incidents, management of critical incident responses, advanced Threat Hunting, and support for junior analysts.
• Threat detection, analysis, and investigation
• Analyze, contextualize, and monitor security alerts from various advanced cybersecurity platforms.
• Investigate security events to identify suspicious activities, potential compromises, and confirmed incidents.
• Perform technical diagnostics necessary for understanding events.
• Communicate investigation results and escalate situations requiring additional expertise or intervention.
• Process security service requests, including inquiries from subsidiaries and various stakeholders.
• Analyze malicious or suspicious files.
• Participate in Incident Response activities when an investigation confirms an incident requiring intervention.
• Participate in Threat Hunting exercises.
• Lead the analysis and contextualization of complex security alerts from various detection platforms.
• Conduct in-depth investigations to identify root causes of incidents.
• Formulate directly actionable technical and operational recommendations.
• Utilize advanced Threat Intelligence to anticipate, identify, and mitigate compromise risks.
• Prepare and conduct advanced Threat Hunting campaigns.
• Provide technical expertise on complex security events and sophisticated threats.
• Security Incident Response
• Contribute to confirmed incident response operations.
• Provide necessary analysis for incident qualification, investigation, and treatment.
• Participate in incident response simulations.
• Ensure transmission and escalation of relevant information to concerned teams.
• Lead high-criticality security incident response operations.
• Coordinate interventions to ensure rapid and effective resolution.
• Ensure coordination with internal and external contacts involved in incident management.
• Define, develop, and implement incident response strategies.
• Design and improve Incident Response playbooks.
• Act as a reference contact point during major incidents.
• Maintain regular communication with SOC management and stakeholders.
• Threat Hunting and collaboration with Cyber Threat Intelligence
• Participate in Threat Hunting sessions in collaboration with the Cyber Threat Intelligence (CTI) team.
• Utilize information on attack techniques and tactics to identify suspicious behaviors.
• Contribute to proactive threat detection and improvement of monitoring capabilities.
• Participate in incident response exercises and simulations.
• Continuous SOC Improvement
• Participate in the optimization of detection use cases (SOC Use Cases).
• Design, maintain, and improve SOC playbooks.
• Develop and evolve Standard Operating Procedures (SOPs).
• Contribute to the improvement of processes, practices, and operational guides.
• Collaborate closely with the SOC RUN Lead to enhance service quality.
• Identify areas for improvement in detection and response capabilities.
• Contribute to the overall improvement of the SOC's security posture.
• Support, coordination, and reporting
• Collaborate with the SOC RUN Lead on continuous improvement actions.
• Support operational managers and SOC management in their various activities and projects.
• Participate in Blue Team skill development initiatives.
• Support and train junior SOC analysts.
• Transmit best practices for investigation and advanced cybersecurity techniques.
• Organize training sessions and technical workshops.
• Foster a culture of learning and continuous improvement.
• Produce detailed reports on security incidents, observed trends, and SOC performance.
• Prepare presentations for management and stakeholders.
• Communicate investigation results and ensure necessary escalations.
• SOC L2: reports to the SOC Manager.
• SOC L3: reports to the SOC RUN Lead.

Project details

• Start: flexible
• Remote: hybrid
• Location: Marseille, France, FR
• Languages: French