Staff Security Operations Engineer

You'll join the Security Operations team, responsible for protecting Ledger's corporate, cloud, SaaS, and data center environments. Its mission: to anticipate, detect, investigate, and respond to cyber threats - including monitoring, alert triage, incident response, detection, visibility, automation, exposure tracking, and continuous process improvement. The scope is distinct from that of the Donjon (product security): SecOps covers the operational security of internal environments, the cloud, endpoints, workloads, identities, and infrastructure. As a close-knit and experienced team - technically demanding and committed to knowledge sharing - we're also continuously building the SOC itself: integrating new log sources, ensuring data quality, expanding detection coverage, and developing reliable dashboards and operational workflows.

Our technical stack includes:

• Splunk for SIEM, investigations, and dashboards;

• CrowdStrike for EDR and endpoint/workload security;

• Wiz for cloud security and exposure management;

• Torq for SOAR and automation;

• AWS, including modern environments such as EKS/Kubernetes;

• An in-house developed Agentic SOC for alert enrichment, correlation, investigation support, reporting, and automation.

AI is at the heart of how we work: investing in AI applied to security is a strategic priority for Ledger this year. We've built our own in-house Agentic SOC, which autonomously investigates weak signals - the large volume of unreliable alerts that a human team couldn't sort through manually - and enriches them, so our engineers can focus on what matters most and resolve incidents faster: high-quality detection, noise reduction, and accelerated investigations.

• Serve as the primary point of contact and coordinator for the most complex incidents across the cloud, corporate systems, endpoints, identities, and the data center.

• Conduct end-to-end investigations: root cause analysis, forensics, timeline reconstruction, and remediation recommendations to prevent recurrence.

• Serve as the team's go-to expert in incident management, ensuring a rigorous and consistent approach to handling, escalating, and documenting incidents.

• Define the team's detection strategy, architecture, and methodology.

• Lead proactive threat hunting by leveraging CTI and OSINT to identify and neutralize risks before they impact Ledger.

• Address the most challenging and emerging detection issues, and translate threat intelligence into concrete improvements in security posture.

• Design and optimize the SIEM (Splunk) architecture and SOAR (Torq) workflows that underpin effective detection, triage, and response.

• Bring our Splunk environment up to standard and state-of-the-art: data quality and standardization (CIM), data models, search performance, and detection governance.

• Build, evolve, and own the architecture of our internal Agentic SOC and our log/data pipeline, and lead the automation of reporting for the SecOps team.

• Apply deep expertise in cloud security (AWS, EKS/Kubernetes) and Wiz (CSPM/CNAPP) to harden the cloud and prioritize large-scale exposure.

• Establish the standards, playbooks, and runbooks that the team relies on.

• Mentor and foster the technical growth of senior and junior engineers, and act as a force multiplier within SecOps.

• Work with the Engineering, Infrastructure, IT, and Cloud teams to align operational security with the organization's objectives.

• 9+ years of experience in security operations, incident response, and CSIRT.

• A strong track record as a technical expert in incident management, threat hunting, and detection engineering.

• Comfortable working both as an individual contributor and as a team player in a fast-paced cloud and SaaS environment.

• In-depth expertise in SIEM (ideally Splunk) and SOAR platforms, as well as CTI/OSINT methodologies.

• Solid knowledge of AWS security (IAM, audit logs, network configurations, workloads, containers, Kubernetes) and cloud security tools (ideally Wiz, CSPM/CNAPP); experience with an EDR (ideally CrowdStrike).

• Strong incident response and forensics skills, with the ability to conduct complex end-to-end investigations.

• The ability to automate tasks and reporting using Python, Bash, APIs, GitHub Actions, a SOAR platform, or equivalent.

• A solid understanding of infrastructure (cloud, networking, containers, CI/CD) and the ability to build and scale: log/data pipelines, integrations, and internal services.

• A strong interest - or experience - in AI applied to security operations, agent-based workflows, and SOC automation.

• Rigor and discipline: You follow and improve established processes and ensure consistency in incident handling and reporting; excellent analytical skills, even under pressure.

• Clear communication of complex technical concepts to cross-functional teams; ability to document thoroughly and escalate issues with the appropriate level of context; awareness of confidentiality and the proper handling of sensitive information.

Find Jobs in France on Arbeitnow