SOC Engineer

Responsibilities

Monitoring and Detection

Security Incident Management

Threat Intelligence and Threat Hunting

Tooling and Continuous Improvement

Governance and Compliance

Technical Environment

The position is part of a hybrid environment combining:

Corporate Environment

Critical Payment Platform

Monitored Sources

Profile Sought

Experience

Required Skills

Technical

Functional

Personal Qualities

Highlights of the Role

• Ensure monitoring of security events reported by SOC tools (SIEM, EDR, etc.).
• Analyze, qualify, and prioritize alerts based on their criticality.
• Participate in the definition, maintenance, and improvement of detection rules and security use cases.
• Handle Level 2 investigations for security incidents.
• Contribute to the continuous improvement of Level 1 incident management processes.
• Participate in the automation of recurring tasks using SOAR capabilities.
• Document analyses performed and write incident reports.
• Escalate situations requiring arbitration or additional expertise.
• Participate in regular threat hunting campaigns.
• Monitor threats and cybersecurity trends relevant to payment activities.
• Identify the most relevant TTPs (Tactics, Techniques & Procedures) and attack vectors for the concerned environment.
• Participate in the integration of new log sources within SOC tools.
• Contribute to the daily operation and optimization of SIEM, EDR/xDR, and SOAR platforms.
• Participate in the evolution of detection and monitoring capabilities.
• Write and maintain SOC operational procedures and playbooks.
• Participate in internal and external security audits.
• Contribute to maintaining compliance with applicable security frameworks.
• User workstations
• SaaS messaging and collaboration tools
• Windows and Linux infrastructures
• Hybrid cloud architecture
• Containerized microservices
• Kubernetes / OpenShift
• Internal and external APIs
• Highly available and highly secure infrastructures
• Network and perimeter security equipment
• Firewalls, proxies, switches
• Active Directory
• Linux and Windows systems
• Cloud and SaaS environments
• IAM solutions (identity and access management)
• Critical cryptographic components for payment transactions (HSM and associated technologies)
• Minimum 4 years of experience as a SOC Analyst or equivalent.
• Operational experience in security monitoring, investigation, and incident handling.
• Good knowledge of SIEM, EDR/xDR, and SOAR solutions.
• Proficiency in infrastructure log analysis.
• Understanding of Active Directory, network, virtualization, Linux, and Windows environments.
• Knowledge of Cloud and SaaS environments (Microsoft 365, Entra ID, Intune).
• Knowledge of Kubernetes and/or OpenShift platforms.
• Solid foundation in incident investigation and analysis.
• Good understanding of the MITRE ATT&CK framework.
• Familiarity with PCI DSS, NIST, and ISO 27001 frameworks.
• Analysis and qualification of security alerts.
• Level 2/3 security incident management and investigation.
• Writing technical documentation and analysis reports.
• Continuous improvement of detection and incident response capabilities.
• Rigor and analytical mind.
• Technical curiosity and eagerness to learn.
• Autonomy and teamwork skills.
• Excellent communication skills.
• Adaptability in rapidly evolving and structuring environments.
• Participate in building a SOC that is rapidly scaling.
• Work in a particularly demanding payment and cybersecurity environment.
• Address issues combining cloud, critical infrastructures, operational security, and compliance.
• Have a direct impact on maturing detection and incident response capabilities.

Project details

Paris

Remote Work: None for the first 3 months, then 3 days of mandatory presence per week (non-negotiable)

Status: Freelance or Portage - No subcontracting

Start Date: ASAP

Context: Payments and Cybersecurity

Reporting to the SOC Manager, the SOC Analyst contributes to the operational security of a critical payment platform, in compliance with major security standards and frameworks (PCI DSS, NIST, ISO 27001, etc.). As the SOC is in a structuring phase, the position offers a strong dimension of construction and continuous improvement, with active participation in the implementation of detection capabilities, alert management, and incident response.

You will work closely with Infrastructure, Cloud, SRE teams, and various business stakeholders.

• Start: ASAP
• Duration: 12 mois
• Remote: hybrid
• Location: 75001, Paris, Île-de-France, FR
• Languages: French