SOC Analyst

Project overview

Context

Reporting to the SOC Manager, the SOC Analyst contributes to the operational security of the platform, in accordance with current requirements (PCI DSS, NIST, IBM FS Cloud, ISO 27001...). The SOC is under construction: they will actively participate in setting up detection capabilities, qualifying alerts, and responding to incidents, in close collaboration with IT, Cloud, SRE, and business teams.

The SOC Analyst will work in a dual environment, typical of the banking and card payment sector:

The SOC Analyst will be responsible for monitoring and analyzing security events from various sources: network and perimeter security equipment, server and workstation operating systems, application components and APIs, cloud infrastructure components, as well as identity and access management systems. The environment also includes cryptography components dedicated to payment transaction processing (hardware security modules), the monitoring of which requires particular vigilance due to their criticality.

Missions

Monitoring & Detection

Security Incident Management

Threat Intelligence & Hunting

Tooling & Integration

Governance & Documentation

Working Conditions

Key Skills Required

Technical Skills

Business Skills

Soft Skills

• A classic Corporate IT environment (workstations, SaaS messaging and collaboration tools, Windows and Linux infrastructure).
• A critical payment platform, hosted in a hybrid cloud environment, based on a microservices architecture that is containerized and orchestrated, exposed via internal and external APIs.
• Ensure the monitoring of security events reported by existing tools (SIEM, EDR, etc.).
• Analyze, qualify, and prioritize alerts according to their criticality.
• Contribute to the definition and improvement of detection rules and use cases, in conjunction with the SOC Manager.
• Perform second-level support for security incidents.
• Continuously improve first-level incident management and automate it through the functionalities offered by SOAR.
• Document analyses and contribute to the drafting of incident reports.
• Escalate incidents exceeding their scope or requiring a decision to the SOC Manager.
• Contribute to regular threat hunting activities.
• Monitor relevant threat intelligence sources for the payment sector.
• Identify threats, TTPs, and attack vectors relevant to the environment.
• Participate in the integration of new log sources into SOC tools (SIEM/SOAR).
• Contribute to the daily operation and tuning of security tools (SIEM, EDR, SOAR).
• Contribute to the drafting and updating of SOC procedures and playbooks.
• Participate in internal and external security audits.
• No remote work for the first 3 months of the assignment.
• 3 mandatory days on-site thereafter.
• Knowledge of SOC tools: Sekoia (SIEM, SOAR) and EDR (Harfanglab and Microsoft Defender EDR).
• Understanding of infrastructure logs (Active Directory, firewall, proxy, switch, virtualization, Linux/Windows OS).
• Familiarity with Cloud/SaaS (Microsoft 365, Entra ID, Intune) and PaaS (Kubernetes/OpenShift) environments.
• Basics in incident analysis and network/system log reading.
• Knowledge of the MITRE ATT&CK framework; sensitivity to PCI-DSS, NIST, and ISO 27001 frameworks is appreciated.
• Analysis and qualification of security alerts.
• Investigation of security incidents (level 2/3).
• Writing clear technical reports and documentation.
• Contribution to the continuous improvement of detection capabilities.
• Rigor and analytical skills.
• Technical curiosity and rapid learning ability, in an agile environment.
• Autonomy and ability to work in a team.
• Good communication, including with non-technical stakeholders.
• Ability to evolve in a changing context, where tools and scope are progressively built.

Project details

• Start: flexible
• Remote: hybrid
• Location: Paris, France, FR
• Languages: French