Senior Python Engineer – Threat Hunting

UST; Paris; Hybrid; EUR 70,000 - 90,000; Full time

Benefits offered by this job

Competitive salary

Hybrid work model

Professional development opportunities

Job summary

A leading cybersecurity firm is seeking a Senior Python Engineer with threat hunting experience to join their managed security services team. The role focuses primarily on engineering, building, and maintaining Python-based automation frameworks supporting proactive threat hunting and security investigations. The ideal candidate will have strong software development skills, hands-on exposure to threat hunting, and experience in enterprise and cloud environments. This position offers a hybrid work model based in Paris.

Qualifications

• Strong experience as a Python developer or software engineer with focus on automation.
• Proven ability to write production-quality Python code following engineering best practices.
• Experience working with structured data formats such as JSON, CSV, and Parquet.
• Familiarity with Python data and analytics libraries.
• Hands-on experience supporting threat hunting or security investigations.

Responsibilities

• Design, develop, and maintain Python-based tools and automation frameworks.
• Build and standardize Jupyter Notebook-based hunting workflows.
• Develop reusable Python libraries, modules, APIs, and tools for scalable hunt execution.
• Engineer data pipelines for security telemetry analysis.
• Perform hypothesis-driven threat hunting and targeted investigations.

Skills

Python development

Automation

Tooling and data processing

Threat hunting experience

Cybersecurity investigations

Tools

Git

Azure

AWS

GCP

Microsoft Sentinel/Defender

Cybereason

CrowdStrike

Pandas

NumPy

Job description

We are looking for Senior Python Engineer with threat hunting experience to join our managed security services team. This role is primarily engineering‑focused, with responsibility for building and maintaining Python‑based automation and analytical frameworks that support proactive threat hunting and security investigations.

The successful candidate will have strong software development experience, complemented by hands‑on exposure to threat hunting or cybersecurity investigations, particularly in enterprise and cloud environments.

Location: Paris, France (Hybrid)

Key Responsibilities

• Design, develop, and maintain Python‑based tools and automation frameworks to support threat hunting and security investigations
• Build and standardise Jupyter Notebook–based hunting workflows, including data enrichment, validation, automation, and reporting
• Develop reusable Python libraries, modules, APIs, and command‑line tools to enable scalable hunt execution
• Engineer data pipelines to ingest, transform, and analyse large volumes of security telemetry
• Perform hypothesis‑driven threat hunting and targeted investigations across endpoint, network, identity, and cloud data
• Orchestrate and schedule automated hunting workflows using pipeline or orchestration platforms
• Collaborate with Threat Intelligence and Detection Engineering teams to translate hunting outcomes into operational detections
• Document methodologies, findings, and recommendations in clear, structured technical reports

Required Experience and Skills

Python / Software Engineering

• Strong experience as a Python developer or software engineer, with a focus on automation, tooling, or data processing
• Proven ability to write production‑quality Python code following standard engineering best practices
• Experience working with structured data formats such as JSON, CSV, and Parquet
• Familiarity with Python data and analytics libraries (e.g., Pandas, NumPy)
• Experience with version control systems (Git) and standard development workflows

Threat Hunting / Security

• Hands‑on experience supporting threat hunting, security investigations, or detection engineering activities
• Working knowledge of adversary techniques and the ability to apply frameworks such as MITRE ATT&CK
• Experience analysing security telemetry from endpoint, network, and cloud environments
• Exposure to hunting or investigation activities in Azure, AWS, or GCP environments
• Experience integrating with security platforms such as Microsoft Sentinel/Defender, Cybereason, or CrowdStrike
• Experience with notebook automation, templating, or report generation
• Familiarity with CI/CD pipelines and DevOps practices
• Relevant security certifications (GIAC, OSCP, CEH, or equivalent)

Additional Information

This role focuses on engineering and automation to support proactive threat hunting. It is not a shift‑based SOC monitoring or alert‑triage position.