SOC Analyst N3

Project overview

We are looking for a Level 3 SOC Analyst for our client in the social protection and insurance sector.

Technical Environment:

CrowdStrike Falcon, Microsoft Defender for Endpoint / Defender XDR, Intune, SIEM (Microsoft Sentinel, Splunk or QRadar), KQL, SPL, CQL / LogScale, Sigma, YARA, MITRE ATT&CK, Windows, Active Directory, Linux, PowerShell, Python, Azure / M365 / Entra ID.

Context:

Within the IT department, the Operational Security team wishes to strengthen its SOC with a Level 3 expert. The objective is to raise the level of detection and incident response, while advancing the cyber maturity of the IT teams. The mission is preferably based in Esvres-sur-Indre (37), otherwise in Paris or Mons-en-Barœul (59), with occasional travel to the main sites (Paris, Mons-en-Barœul, Chartres, Esvres).

Missions:

Expected Skills:

EDR, CrowdStrike Falcon, Microsoft Defender for Endpoint, KQL, SPL, SIEM, Threat Hunting, Forensic, Incident Response, Crisis Management, MITRE ATT&CK, CTI, Sigma, YARA, Windows, Active Directory, Linux, SOAR, PowerShell, Python.

Profile:

An experienced SOC Analyst, you have solid experience in Level 3 investigation and incident response within a SOC or CERT. Operational mastery of CrowdStrike Falcon and Microsoft Defender for Endpoint is a prerequisite. As a pedagogical person with a real advisory posture, you know how to make cyber issues accessible to non-specialist teams as well as management. Rigorous, calm in crisis situations, and with good synthesis skills, you are comfortable in writing and speaking. Knowledge of ANSSI, NIST CSF, NIS2, or DORA frameworks will be a real plus.

Work Environment:

Confirmed expertise in EDR CrowdStrike Falcon (Advanced Event Search, CQL / LogScale, Real Time Response, Custom IOA) and Microsoft Defender for Endpoint (Advanced Hunting in KQL, Live Response, AIR) is essential. You have mastered the analysis of Windows, Active Directory, and Linux systems, as well as forensic triage and memory analysis. You know how to design detection and correlation rules on a SIEM (Sentinel, Splunk, or QRadar) in KQL or SPL, using Sigma, YARA, and the MITRE ATT&CK framework. NIST and SANS incident response methodologies are familiar to you.

• Take over incidents escalated by levels 1 and 2, conduct in-depth investigations, identify the origin of attacks, and propose corrective actions.
• Operate EDR consoles (CrowdStrike Falcon, Microsoft Defender) to deeply analyze Windows and Linux workstations and servers.
• Conduct threat hunting campaigns guided by CTI and the MITRE ATT&CK matrix.
• Design and refine detection rules, EDR policies, and SOC use cases to limit false positives.
• Provide support during cyber crises and incident response phases.
• Act as a security referent for infrastructure, network, workstation, application, and project teams.
• Train N1/N2 analysts through knowledge transfer and awareness sessions.
• Build SOC activity and EDR coverage indicators and dashboards, and present them in committees.
• Write and maintain security standards, procedures, guides, and playbooks.

Project details

• Start: 30/11/2026
• Duration: 4 mois renouvelable
• Location: Esvres, Centre-Val de Loire, FR
• Languages: French