Expert Incident Response Engineer M/F

Orange Business; United States; Remote; USD 73,000 - 106,000; Full time

Job summary

Orange Cyberdefense in France is seeking a forensic specialist Engineer to join a team of Technical Experts who specialize in incident response, threat intelligence and reverse engineering.

You will handle investigations on client systems, build expertise across RAM, malware analysis, and timeline reconstruction, and contribute to tooling and post-incident reviews. Proficiency in Linux/Windows, cloud environments, and scripting is required, with fluency in French and English.

Qualifications

• Minimum 3 years in information security with hands-on incident response.
• Experience in forensic analysis and network analysis.
• Ability to write technical reports in French and English.
• Comfortable working autonomously or in a team, on call for critical incidents.

Responsibilities

• Intervention on client information systems in case of compromise, conducting end-to-end investigations.
• Determination of the root causes of an incident.
• Assessment of the technical and business impact.
• Analysis of attacker actions and artifacts within the compromised scope.
• Reporting and drafting deliverables.
• Design and development of state-of-the-art analysis tools.
• Participation in internal development projects.
• Contribute to post-incident lessons learned.

Skills

Forensic analysis

Incident response

Threat intelligence

Reverse engineering

Automation scripting

French & English writing

Autonomy / teamwork

Tools

GNU/Linux

Windows

AWS

M365/EntraID

Python

PowerShell

Job description

Location: France

Your role

As a forensic specialist Engineer, you will join a team of Technical Experts specialized in incident response, threat intelligence, reverse engineering…

You will develop your technical expertise by taking part in the various investigation and incident response missions of the Orange Cyberdefense CSIRT:

• Intervention on client information systems in case of compromise, conducting end-to-end investigations (initial incident qualification, evidence collection, forensic analysis to reconstruct the incident timeline);
• Determination of the root causes of an incident;
• Assessment of the technical and business impact;
• The most exhaustive possible analysis of the attacker's actions within the compromised scope;
• Reporting and drafting of deliverables;
• Design and development of state-of-the-art analysis support tools;
• Participation in internal development projects;
• Contribution to post-incident lessons learned

Your main mission:

• Digital investigation on any type of operating system;
• Establishment of a forensic timeline;
• Analysis of random access memory (RAM);
• Malware analysis (contacted servers, persistence mechanisms, artifacts enabling detection across a fleet, propagation, etc.);
• Reverse engineering and decryption of any malware-related element (network communications, configuration files, files storing stolen data, etc.).

You may be required to be on call for critical incidents

Your profile

YOUR PROFILE

You have pursued your passion for the field of information security for at least 3 years.

You have solid experience in penetration testing or SOC L2/L3, and ideally some experience in forensic analysis, network analysis, doubt removal (alert triage),…

You enjoy sharing your knowledge, developing your ideas, working autonomously or in a team, and keeping up with the evolution of information security.

Conscientious and with good writing skills, you are able to speak, read and write technical texts in French as well as in English.

You have strong curiosity and a desire to get to the bottom of things.

Skills and Technologies:

Proficiency in GNU/Linux and Windows environments (system artifacts, event logs, file structures), also in Cloud environments (M365/EntraID, AWS); ability to automate recurring tasks in a scripting language (Python, PowerShell)

Entité

Orange Cyberdefense is the strategic entity of the Orange Group dedicated to digital security. We support companies of all sizes, critical organizations, government bodies and local authorities in designing their cybersecurity strategies, implementing them and managing them operationally.

We bring our expertise to them to ensure the best level of protection for their data, their equipment and the services they offer to their customers or citizens.

With revenue of 1,3 Md€ en 2025, and more than 3.300 experts dedicated to cybersecurity, we now position ourselves as the European leader in the cyberdefense market.

Our mission is to build a safer digital society.