> Markdown version of [/jobs/ext/414667-csirt-analyst](https://www.wearedevelopers.com/jobs/ext/414667-csirt-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # CSIRT Analyst - **Company:** EQUANS France - **Location:** Courbevoie, France - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Microsoft Azure, Cyber Security, Disaster Recovery, Monitoring of Systems, Identity and Access Management, Information Sciences, Data Intelligence, Intrusion Detection and Prevention, Microsoft Security Essentials, Red Team (Cyber Security), Kusto Query Language, Technical Data Management Systems, Cloud Platform System, Malware, Cyber Threat Analysis, Information Technology, Network Server - **Published:** June 4, 2026 - **Apply:** https://fr.indeed.com/viewjob?jk=b484c70fd1ee33e0 ## About the Role Do you have a Master's degree?, Engineering degree (Master's level or equivalent) in computer science, cybersecurity, information sciences, or a related field. Specialization in Threat Intelligence, threat analysis, or offensive security (e.g., via a Master's in cybersecurity or certifying programs from ENISA or Romanian universities such as the Polytechnic University of Bucharest) would be a major asset. Continuous training in cybersecurity (MOOCs, bootcamps) is appreciated to demonstrate ongoing skill updates. At least 3 years of experience in a similar cybersecurity role, ideally within a CSIRT, SOC, or Threat Intelligence team. Proven expertise in Threat Intelligence is essential: you must have hands-on experience in monitoring and analyzing TTPs of cyber threat actors, enriching IoC, and producing actionable reports based on intelligence data. Behavioral Capabilities * Strong leadership skills * Excellent problem-solving and analytical skills, with the ability to troubleshoot complex access governance issues and implement effective solutions. * Ability to communicate effectively with both technical and non-technical stakeholders, ensuring clarity in explaining complex technical concepts. * Strong collaboration skills, working seamlessly with cross-functional teams such as IT, security, and compliance. * You demonstrate interest and skills in developing task automation * Good communicator, you have interpersonal skills and you adapt easily to various people; * You have a sense of ethics, and know how to exercise discretion; * You are fluent in English and willing to work in an international context. * Comfortable working in a multicultural, distributed team. * You have an excellent methodological approach to managing incident responses; Skills * You have technical background demonstrating the ability to perform the assigned tasks; * You are autonomous, technically versatile and have the ability to tackle new and stimulating technical subjects; * You master monitoring and intrusion detection tools, as well as incident management systems; * You are competent in static malware analysis; * You have one or more certifications related to incident response (SANS, OSCP, etc.) and possibly cyber threat intelligence are desirable. ## Description Within the CSIRT of Equans, you ensure the initial detection, preliminary assessment and response to IT security incidents. By examining the technical data collected, you identify the attackers' modus operandi, determine their objectives and evaluate the extent of the attacks in order in particular to search within the environment for elements that could indicate a potential compromise. Through an investigation report, you offer recommendations to resolve problems and strengthen the security of affected systems. You suggest actions to take to thwart and resolve the incident, including cleaning and strengthening the security of affected systems. You carry out constant monitoring of new vulnerabilities, emerging technologies and attack methods linked to system components, by developing appropriate investigation tools. KEY METRICS OF THE ENVIRONMENT * Identities managed: 95,000 * Workstations: 60000 * Servers: 6500 * Hosting: 80% of the IT are managed on Azure and AWS * Teammates: 4 in France for a total of 17 people in the CSIRT (3 incident handlers in Montreal CA) * Knowledge and toolings: + Must know KQL queries + Use of EDR solutions + Good knowledge of Microsoft security solutions + Good knowlegde of Cloud environments + knowledge of Threat Intelligence platform solution + Use of SIRP + Use of Feedly for cyber watch KEY OBJECTIVES & KPIs * Leading at least 3 campaigns to improve our overall detection (Defining audit logs, assist Cyberdefense architects for data collection and parsing, identifying risks, use cases and associated detection rules, build incident responses); * Carrying out structured threat hunting, based on a hypothesis, in order to identify weak signals within our environment; * Producing every month an internal threat report for a specific Business Unit; * Animating public and corporate events to improve our overall visibility and share our insights with other teams; * Creating playbooks to improve our incident response processes, * Carry out structured threat hunting in order to identify weak signals within our environment; * Enrich and integrate TTPs and indicators of compromise into monitoring tools; * Produce actionable reports based on threat intelligence data; * Perform real-time incident response in order to participate in the whole lifecycle of the incident (identification and monitoring of the attack path, collection of artifacts for forensic analysis, threat analysis and remediation actions); * Propose new rules and means to be implemented to improve our overall detection; * Participate in intrusion tests and red team missions; * Be a major actor in the development of the threat intelligence platform; * Introduce information related to cybersecurity to improve awareness and implementation of security practices; * Develop and maintain relationships with experts or organizations that can help or participate in the CSIRT's mission; * Continuously improve the service provided and report to the CSIRT manager; * Support the CSIRT manager in the preparation of committees In conjunction with Equans internal teams and partner teams: * Inform management of suspected incidents and explain the history by providing punctual feedback with the status and potential impact of the event; * Provide advice on disaster recovery, emergency and business continuity plans, at the tactical, operational and strategic levels; * Recommend measures to circumvent and remediate the incident., Join a dynamic team of passionate professionals, actively involved in prestigious cybersecurity collaboration networks. Be part of a culture that values excellence, innovation, and mutual support. Challenging Topics Contribute to multiple high-impact projects that tackle real-world cybersecurity challenges. Your expertise will make a difference. Empowered Voices Your ideas matter. As a valued team member, your input will be heard, respected, and considered in decision-making processes. Technical Growth Advance your skills through tailored training programs and hands-on experience. We invest in your development to help you reach your full potential. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Kubernetes Security - Challenge and Opportunity](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) - [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Jobs in Tech: The State of the European Market](https://www.wearedevelopers.com/magazine/575-jobs-in-tech-the-state-of-the-european-market) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)