Experienced SOC Analyst N2/N3 - Cloud & Threat Hunting

Project overview

Context

The Security Incident Detection and Response team (SOC/CERT) wishes to strengthen its advanced investigation and detection capabilities in the face of evolving threats, especially in Cloud environments.

We are looking for an experienced profile capable of conducting complex investigations, proactively identifying malicious activities, and actively contributing to the continuous improvement of the team's detection and response capabilities.

Beyond incident handling, we are looking for a professional passionate about cybersecurity, curious, autonomous, and proactive, capable of initiating hunting actions, improving detection use cases, and continuously advancing the SOC's capabilities.

Main Missions

Detection and Incident Response

Cloud Investigation

Threat Hunting

Continuous Improvement

Required Technical Skills

Investigation and Incident Response

Cloud Security

Proven experience with at least two of the following platforms:

Skills sought:

SOC Tools

Scripting

Ability to develop or adapt scripts:

Profile Sought

Experience

Expected Qualities

We are not looking for a simple ticket-handling analyst.

The contractor will need to:

Differentiating Criteria

Candidates with the following skills will be particularly appreciated:

o GCFA

o GCIH

o GCIA

o SC-200

o AZ-500

o AWS Security Specialty

o CCD

o CARTP/CRTP

The contractor is expected to proactively contribute to improving the SOC's detection and investigation capabilities. In the absence of an ongoing incident, they will dedicate their time to threat hunting, improving detection use cases, operational monitoring, and identifying continuous improvement opportunities.

• Ensure the qualification, analysis, and handling of security incidents at level 2 and 3.
• Conduct in-depth technical investigations to identify the cause, scope, and impact of an incident.
• Lead or contribute to containment, eradication, and remediation actions.
• Produce investigation reports and associated lessons learned.
• Participate in cyber crisis management exercises and post-incident investigations.
• Conduct compromise analyses in AWS, Azure, and GCP environments.
• Utilize cloud security logs to identify abnormal or malicious behavior.
• Investigate account compromises, privilege abuse, lateral movements, and data exfiltrations.
• Contribute to improving visibility, logging, and detection in cloud environments.
• Design and execute Threat Hunting campaigns based on threat intelligence, MITRE ATT&CK TTPs, and compromise hypotheses.
• Proactively identify malicious activities not detected by existing mechanisms.
• Formalize and share hunting campaign results.
• Transform findings from hunting into new detection use cases, SIEM rules, or SOAR automations.
• Continuously evaluate the effectiveness of detection mechanisms.
• Propose and implement new detection use cases.
• Participate in enriching investigation and response playbooks.
• Support the skill development of the SOC team.
• Conduct active monitoring of new threats, attack techniques, and detection methods.
• Forensic analysis and security investigation.
• Incident response methodologies.
• Log analysis and event correlation.
• Knowledge of the MITRE ATT&CK framework.
• Knowledge of cyber kill chains and adversary TTPs.
• Microsoft Azure
• Amazon Web Services (AWS)
• Google Cloud Platform (GCP)
• Azure Activity Logs, Entra ID, Defender for Cloud.
• AWS CloudTrail, GuardDuty, IAM, Security Hub.
• Google Cloud Audit Logs, Cloud IAM, Security Command Center.
• Cloud environment incident investigation.
• Analysis of risks related to cloud identities, privileges, and configurations.
• SIEM: Splunk (mandatory)
• SOAR
• EDR: Microsoft Defender for Endpoint, CrowdStrike
• ServiceNow
• CTI tools and Threat Intelligence platforms
• Python
• PowerShell
• KQL
• SPL Splunk
• Minimum 5 years of experience in a SOC, CERT, or CSIRT.
• Demonstrated experience in complex investigations.
• Significant experience with security incidents involving cloud environments.
• Be autonomous and proactive.
• Demonstrate strong technical curiosity.
• Be able to identify areas for improvement independently.
• Show a real appetite for Threat Hunting.
• Be proactive when no incident is being handled.
• Constantly seek to improve the quality of detection and response.
• Actively contribute to the maturity of the SOC.
• Possess excellent analytical and synthesis skills.
• CERT or CSIRT experience.
• Regular execution of Threat Hunting campaigns.
• Creation of advanced detection rules.
• Mastery of MITRE ATT&CK.
• Purple Team knowledge.
• Certifications such as:

Project details

• Start: 2026-11-09
• Duration: 12 mois (renouvelables)
• Location: 72000 LE MANS, FR
• Languages: French