Security Operations Center Expert

Talantir; Paris; Hybrid; EUR 85,000 - 110,000; Full time

Job summary

Talantir is seeking a SOC Expert to detect, investigate, and respond to security threats across a global infrastructure. You will lead day-to-day incident response, improve detection coverage and quality, and develop SOAR automation to reduce response time and workload.

You will be a key contact for user-reported security concerns and collaborate with Infrastructure teams to strengthen security posture. Based in Paris with a hybrid setup (3 days onsite, 2 days at home), you will map detections

Qualifications

• Requires degree in CS/Cybersecurity or related field.
• 5+ years of SOC experience in SLA-driven environments.
• Strong SIEM, SOAR, and detection engineering skills.
• Experience mapping detections to MITRE ATT&CK framework.
• AWS experience; Azure a plus.

Responsibilities

• Lead incident response with triage, containment, eradication, and recovery.
• Tune and enhance SIEM detection rules to reduce false positives.
• Develop and deploy automated playbooks with SOAR.
• Create dashboards and reports to track SOC KPIs (MTTD/MTTR).
• Collaborate with Infrastructure and Operations to strengthen security posture.

Skills

SOC operations

Incident response

Threat detection

MITRE ATT&CK mapping

SIEM tuning

SOAR automation

Python/Bash/PowerShell

Networking fundamentals

English & French

Education

Degree in Computer Science or Cybersecurity

Tools

SIEM

SOAR

AWS

Git-based workflows

Job description

Lenstra was founded by passionate computer science engineers with a proven track record of delivering high-quality solutions. By combining technical excellence with a strong vision, we support top-tier clients across industries such as Banking & Insurance, Luxury, and Technology.Our expertise is structured around four core pillars: Software Development, DevSecOps, Data & AI, and Product. Through a holistic understanding of our clients’ environments, we help them address their most complex challenges—from building robust software and secure cloud platforms to designing data-driven solutions that accelerate business impact.

About the role

We are looking for a SOC Expert to detect, investigate, and respond to security threats across a global infrastructure. You will lead day-to-day incident response, improve detection coverage and quality, and develop SOAR automation to reduce response time and operational workload. You will also act as a key contact for user-reported security concerns and collaborate closely with Infrastructure and Operations teams to strengthen overall security posture and improve KPIs such as MTTD and MTTR.

The successful candidates will manage:

• Incident Response & Case ManagementTriage, investigate, and resolve security incidents within SLA.
• Coordinate containment, eradication, and recovery efforts.
• Handle user-reported security issues and escalte when necessary.
• Maintain clear documentation in case management systems.
• Detection EngineeringDevelop and tune SIEM detection rules to improve coverage and reduce false positives.
• Integrate new log sources and enhance monitoring visibility.
• Map detections and investigations to the MITRE ATT&CK framework.
• Build dashboards and reports to track SOC performance and risk.
• SOAR & AutomationDesign and implement automated playbooks (e.g., endpoint isolation, IP blocking, account disabling).
• Integrate security tools to streamline response workflows.
• SOC Tooling & Platform OperationsMaintain and optimize SIEM, SOAR, and related security platforms.
• Perform updates, health checks, and configuration improvements.

Requirements:

• Degree in Computer Science, Cybersecurity, or related field.
• 5+ years of SOC experience in high-volume, SLA-driven environments.
• Strong expertise in SIEM (rule creation, tuning, dashboards) and SOAR automation.
• Experience in detection engineering, log analysis, and false-positive reduction.
• AWS experience required; Azure is a plus.
• Experience mapping detections to MITRE ATT&CK.
• Scripting skills: Python, Bash, PowerShell.
• Strong knowledge of networking protocols (TCP/IP, DNS, HTTP/S, SSL/TLS, firewalls).
• Proficiency in Linux and Windows environments.
• Experience with CI/CD and Git-based workflows.
• Certifications such as CISSP, GCIA, GCIH, CEH, and/or SIEM/SOAR preferred.
• Fluent in English and French.

Location:

This job is based in Paris, on a hybrid set-up (3 days onsite, 2 days at home).

Our recruitment process consists in 3 interviews:30 minutes recruiter screen1h role and cultural fit interview1h Dive Deep interview