[Le Mans] - SOC Analyst N2/N3 RFP-271519-1 for Covéa

Project overview

Covéa is seeking an autonomous, proactive SOC Analyst to handle level 2 and 3 incidents and strengthen detection and threat-hunting activities. The role requires at least five years in a SOC, CERT, or CSIRT, complex incident investigations including cloud incidents, Splunk, and proven experience with at least two of AWS, Azure, and GCP. The work also includes threat hunting, incident reporting, detection improvements, and support for cyber crisis exercises.

CERT/CSIRT background, advanced detection engineering, Purple Team experience, and relevant security certifications are differentiators; SOAR, EDR, ServiceNow, CTI platforms, and scripting are named tools or skills, but only Splunk is explicitly stated as required. The contract is based in Le Mans, with no work mode specified; the stated experience band is 5–10 years, consistent with the description’s five-year minimum.

Responsibilities

• Incident detection and response: qualification, analysis and treatment of level 2 and 3 incidents; in-depth technical investigations (cause, extent, impact); management of containment, eradication and remediation; investigation reports and REX; cyber crisis exercises.
• Cloud Investigation: Compromise analytics on AWS, Azure, and GCP; Leverage cloud logs. investigation of account breaches, abuse of privileges, lateral movements and exfiltrations; Improved cloud visibility and discovery.
• Threat Hunting: campaigns based on CTI, MITRE ATT&CK TTP, and compromise assumptions; Proactive detection of uncovered activity; Transformation of discoveries into detection, SIEM rules, or SOAR automations.
• Continuous improvement: evaluation of detection mechanisms, new use cases, enrichment of reflex sheets, development of the team's skills, active monitoring of threats.
• Investigation: forensics, incident response methodologies, log analysis and correlation, MITRE ATT&CK, cyber kill chains and TTP.
• Cloud: Proven experience on at least 2 of the 3 platforms — Azure (Activity Logs, Entra ID, Defender for Cloud), AWS (CloudTrail, GuardDuty, IAM, Security Hub), GCP (Cloud Audit Logs, Cloud IAM, Security Command Center).
• SOC tools: Splunk (required), SOAR, EDR (Defender for Endpoint, CrowdStrike), ServiceNow, CTI platforms.
• Scripting: Python, PowerShell, KQL, SPL (Splunk).
• Experience: minimum 5 years in SOC/CERT/CSIRT, with complex investigations including incidents in a cloud environment.

Requirements

• At least 5 years of experience in a SOC, CERT, or CSIRT
• Level 2 and 3 incident response, including qualification, investigation, containment, eradication, and remediation
• Complex technical investigations, including cloud incidents, with forensic analysis and log correlation
• Proven security experience on at least two of AWS, Azure, and GCP
• Splunk
• Threat hunting using CTI, compromise hypotheses, and MITRE ATT&CK TTPs
• Detection evaluation and improvement, including creating or refining SIEM detection use cases

Project details

• Start: flexible
• Remote: hybrid
• Location: France, FR