Principal SOC Analyst

Integrity360; Paris; On-site; EUR 65,000 - 95,000; Full time

Benefits offered by this job

Flexible Working Arrangements

Health Insurance

Pension

Job summary

Integrity360 is seeking a Principal SOC Analyst in Paris to act as a Level 3 escalation point, providing advanced support during complex investigations and strengthening detection capabilities across SIEM, EDR, NIDS, and SOAR. The role includes mentoring junior staff, tuning alerts, and collaborating with OT security practices.

You will work with customers and internal stakeholders to improve cyber security posture, investigate incidents, and develop robust monitoring strategies in a fast-paced

Qualifications

• Experience in security operations and incident response.
• Strong hands-on knowledge of SIEM, EDR, NIDS, SOAR, DLP.
• Ability to produce clear technical documentation and customer-facing recommendations.

Responsibilities

• Act as Level 3 escalation point for advanced investigations.
• Lead complex security investigations including containment and remediation.
• Develop detection use cases, correlation rules and alerting logic.
• Mentor Level 1 and Level 2 analysts as required.
• Collaborate with OT security practices in IT/OT environments.

Skills

Incident response

Threat hunting

SIEM

EDR

NIDS

SOAR

Threat intelligence

Tools

Microsoft Sentinel

Splunk

Palo Alto

Suricata

Job description

• In this role, you will act as a Level 3 escalation point within the MDR/SOC function, providing advanced technical support to Level 2 analysts during complex or high-severity investigations. You will be expected to bring deep operational knowledge across modern security technologies, including SIEM, EDR, Network Intrusion Detection Systems, SOAR, DLP and related security monitoring platforms
• The Principal SOC Analyst will support the investigation, containment and remediation of advanced threats, ensuring that incidents are analysed in the correct business and technical context. The role requires strong hands-on experience in security operations, incident response, threat analysis and detection tuning, as well as the ability to work directly with customers and internal stakeholders to improve detection capability and strengthen cyber security posture
• You will contribute to the continuous improvement of the MDR service by supporting the definition of security monitoring strategies, improving detection logic, tuning security technologies, reviewing investigation processes and advising customers on technical optimisation opportunities. A strong understanding of malware behaviour, adversary tactics, techniques and procedures, and emerging threats will be critical to success
• This role contributes to the development of Operational Technology (OT) security monitoring and incident response capabilities, as part of the integration of industrial environments into our Global SOC model
• Act as the Level 3 escalation point for advanced, complex or high-impact security investigations
• Support Level 2 analysts during complex investigations, providing technical guidance, validation and direction
• Perform in-depth analysis of security events, alerts, logs, endpoint telemetry, network traffic and other relevant data sources
• Lead advanced incident investigations, including scoping, containment, eradication and remediation recommendations
• Analyse malicious activity, suspicious files, attacker behaviour and adversary TTPs
• Support customers from a technical perspective in the optimisation, tuning and improvement of their security monitoring capabilities
• Review and improve SIEM, EDR, NIDS, SOAR and other security tool configurations to reduce false positives and improve detection quality
• Contribute to the development and refinement of detection use cases, correlation rules, alerting logic and investigation playbooks
• Support the definition of customer security monitoring strategies based on risk profile, threat landscape and available telemetry
• Provide technical recommendations to strengthen customer cyber security posture and improve resilience against current and emerging threats
• Conduct threat hunting and proactive analysis based on indicators, behaviours, intelligence and attack patterns
• Document investigation findings, evidence, timelines, containment actions and remediation recommendations in a clear and structured manner
• Prepare and deliver technical reports to customers, partners and internal stakeholders
• Monitor trusted sources for emerging threats, vulnerabilities and adversary activity relevant to customer environments
• Contribute to the continuous improvement of SOC processes, procedures, documentation and knowledge base material
• Support mentoring and technical development of Level 1 and Level 2 analysts where required
• Lead and support investigations involving Operational Technology (OT) / Industrial Control Systems environments, including IT/OT convergence scenarios
• Analyse security events related to industrial assets and protocols (e.g. SCADA systems, DCS, PLCs, HMIs)
• Support incident response activities, in close collaboration with the Group Incident Response Team for complex security incidents, including those impacting IT and OT environments (scoping, containment, eradication and post-incident analysis)
• Contribute to the development and fine-tuning of OT-specific detection use cases, monitoring strategies and incident response playbooks
• Collaborate closely with the Group’s OT Security Practice, leveraging industrial expertise to enhance SOC monitoring, detection and response capabilities

Benefits

• Flexible Working Arrangements
• Career Development Opportunties
• Health Insurance
• Pension
• Large Training & Upskilling Budget

Ability to analyse endpoint, network, identity, cloud and application telemetry in support of complex investigationsExperience with OT security platforms or NDR (e.g. Armis, Nozomi, Clarity, Dragos, Darktrace) is a plusUnderstanding of IT/OT convergence challenges and network segmentation practices (e.g. IEC 62443)Experience with cloud security monitoring across Microsoft Azure, AWS or Google Cloud is beneficialExperience supporting industrial or critical infrastructure environments is a plusStrong experience with security event triage, correlation, investigation and escalationMinimum 2–3 years of experience in a SOC, MDR, incident response, CSIRT or cyber security operations roleExperience supporting customer-facing technical discussions, including investigation reviews, tuning recommendations and posture improvement activitiesWorking knowledge of SIEM, EDR, SOAR, NIDS, DLP and threat intelligence platformsKnowledge of OT threat landscape and frameworks (e.g. MITRE ATT&CK forICS)Ability to produce clear technical documentation, investigation reports and customer-facing recommendationsStrong understanding of incident response lifecycle, including preparation, identification, containment, eradication, recovery and lessons learnedStrong understanding of attacker tactics, techniques and procedures, including MITRE ATT&CKExperience supporting customers or internal stakeholders with security optimization, detection tuning and cyber security posture improvementUnderstanding of OT / ICsevironments (SCADA, DCS, PLCs, HMIs, industrial networks)Ability to perform host-based and network-based threat analysisDeep operational knowledge of SIEM, EDR, Network Intrusion Detection Systems, SOAR, DLP and related security monitoring technologiesStrong understanding of enterprise network architecture, TCP/IP, firewalls, proxies, VPNs, DNS, email security and cloud environmentsExperience analysing packet captures, endpoint artefacts, logs, scripts, documents and potentially malicious filesExperience with Microsoft Sentinel, Microsoft Defender, Splunk, QRadar, CrowdStrike, SentinelOne, Palo Alto, Suricata, Zeek, Snort or similar technologies is highly beneficialStrong hands-on experience in Security Operations Centre or MDR environmentsExperience with threat hunting, detection engineering or purple team activities is beneficialAbility to manage multiple complex incidents and make effective decisions under pressureExperience working with threat hunting methodologies and security detection frameworksStrong written and verbal communication skills, with the ability to explain technical findings to both technical and non-technical stakeholdersProven experience handling complex security incidents and supporting advanced investigationsExperience with SIEM query languages and detection logic, such as KQL, SPL, Sigma or equivalentFamiliarity with industrial protocols (e.g. Modbus, OPC, IEC 104, DNP3) is beneficialUnderstanding of security protocols, encryption technologies and common authentication mechanismsExperience tuning security controls and detection content to improve alert fidelity and reduce false positivesSecurity industry certifications such as GCIH, GCFA, GCIA, GNFA, GCTI, GSEC, CISSP, CySA+, SC-200, AZ-500 or equivalent are highly beneficialOT-related certifications or training (e.g. GICSP, GRID, IEC 62443) are advantageous