Senior Security Operations Engineer

Capital Fund Management (CFM); Paris; Sur place; EUR 60 000 - 80 000; Plein temps

Résumé du poste

A leading asset management firm in Paris seeks a Senior Security Operations Engineer (SOC L3) to enhance its security posture across a hybrid environment. Duties include leading incident investigations, threat hunting, and improving security tooling while collaborating with IT teams. The ideal candidate has over 5 years of experience in security operations and incident response, alongside a Bachelor's degree in a relevant field. Fluency in French and English is required, and remote work is allowed up to two days per week.

Qualifications

• 5+ years in security operations or incident response roles.
• Hands-on experience with a modern security stack.
• Solid knowledge of AWS security foundations.
• Strong application security knowledge.

Responsabilités

• Operate and improve security platforms.
• Lead incident response for critical alerts.
• Proactively hunt for threats.

Connaissances

Security operations

Security engineering

Incident response

AWS security

Application security

Automation/scripting

Networking fundamentals

Fluency in French

Fluency in English

Formation

Bachelor's degree in computer science or Information Security

Outils

SIEM

SOAR

EDR

WAF

Vulnerability management

Python

Description du poste

Founded in 1991, we are a global quantitative and systematic asset management firm applying a scientific approach to finance to develop alternative investment strategies that create value for our clients. We value innovation, dedication, collaboration, and the ability to make an impact. Together, we create a stimulating environment for talented and passionate experts in research, technology, and business to explore new ideas and challenge existing assumptions.

Your Role

Join our Security team as a Senior Security Operations Engineer (SOC L3) and help strengthen our security posture across a hybrid environment (on‑prem and AWS).

Directly reporting to our Security Operations Lead, you will participate in CSIRT/CERT operations, lead advanced incident investigations, conduct threat hunting and forensic analysis, and continuously improve our detection and response capabilities.

You will also operate and evolve our security tooling (e.g., SIEM, SOAR, EDR, WAF, vulnerability management) and partner with technical teams to embed security by design through reviews and threat modeling.

You will partner closely with our IT teams to drive remediation and reliability.

Key Responsibilities

Security operations platform ownership

• Operate, maintain, and continuously improve security platforms (SIEM/SOAR, endpoint security, vulnerability management, web protection, email/security controls, secrets management, etc.).
• Ensure platform availability, performance, and resilience through upgrades/patching, configuration reviews, access controls, health checks, and periodic validation/testing.
• Improve telemetry quality: logging coverage, data onboarding/normalization, retention requirements, and integration of reliability.

SOC L3 escalation, incident response & forensics

• Act as the SOC L3 escalation point for critical alerts and major incidents; leading advanced investigations and guide containment/eradication decisions.
• Deliver incident outputs: timeline, root-cause analysis, impact assessment, lessons learned, and actionable remediation recommendations.
• Continuously improve response readiness by refining playbooks/runbooks, tuning detection logic, and identifying automation opportunities.

Threat hunting & detection engineering

• Proactively hunt for threats across endpoints, cloud, and network telemetry.
• Convert findings into durable outcomes: new detections, improved alert fidelity, automated enrichment, and clearer triage guidance.

External security activities

• Coordinate external security partners (penetration tests, vulnerability assessments, purple-team exercises): scope, rules of engagement, access coordination, scheduling, and tracking.
• Triage findings, prioritize remediation, and drive closure with internal stakeholders.

Your Skills

Must-Have

• Bachelor's degree in computer science, Information Security (or related) or equivalent professional experience.
• 5+ years in security operations / security engineering / incident response roles.
• Hands-on experience operating and improving a modern security stack (e.g., SIEM, SOAR, EDR, WAF, vulnerability management).
• Strong AWS security foundations (IAM, networking/VPC concepts, native controls, logging/monitoring strategy).
• Solid application security knowledge (AuthN/AuthZ, OWASP Top 10, API security, CSP concepts).
• Proven incident response experience: investigation, containment, eradication, RCA (forensic experience valued).
• Strong networking fundamentals (TCP/IP, HTTP/S, DNS, SMTP, SSH, TLS, firewalling) and ability to analyze logs/traffic.
• Ability to develop and maintain automation/scripts (Python required).
• Fluency in French and English.

Nice-to-Have

• Security certifications (e.g., CISSP, GCIA/GCIH, SIEM-related) or equivalent experience.
• Experience in regulated industries (healthcare/fintech/govtech).
• Comfortable working cross-functionally with Security, IT, Engineering, and Compliance.
• Familiarity with engineering workflows (Git-based collaboration, CI/CD concepts).

Note

• Remote work is permitted for up to two days per week.
• This position involves taking part in on-call responsibilities.

EQUAL OPPORTUNITIES STATEMENT

We are continuously striving to be an equal opportunity employer and we prohibit any discrimination based on sex, disability, origin, sexual orientation, gender identity, age, race, or religion. We believe that our diversity, breadth of experience, and multiple points of view are among the leading factors in our success. CFM is a signatory of the Women Empowerment Principles.