> Markdown version of [/jobs/ext/425920-customer-cyber-defense-engineer](https://www.wearedevelopers.com/jobs/ext/425920-customer-cyber-defense-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Customer Cyber Defense Engineer - **Company:** EQUANS France - **Location:** Courbevoie, France - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Amazon Web Services, Microsoft Azure, Business Systems, Cloud Computing, Cloud Computing Security, Configuration Management, CompTIA Security+, Cyber Security, Continuous Integration, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Local Security Policy, Parsing, Performance Tuning, Windows PowerShell, Runbook, Security Information and Event Management, Software Engineering, Management of Software Versions, Software Vulnerability Management, Scripting, Google Cloud, Information Technology, Cyber Warfare, Network Server - **Published:** June 10, 2026 - **Apply:** https://fr.indeed.com/viewjob?jk=3ac00a2f1973c24a ## About the Role Do you have a Master's degree?, * Master's or Engineering degree in cybersecurity, computer science, Information Technology, software engineering, or a related field (or equivalent proven experience). * 3 to 7 years of experience in a technical cybersecurity role, ideally in one (or a mix) of the following areas: SOC engineering, security tooling integration, automation, detection engineering, or security operations engineering. * Proven hands-on experience operating and evolving security tooling in production, with a focus on reliability, maintainability and scalability (configuration management, upgrades, monitoring, troubleshooting). * Demonstrated experience onboarding new environments to security tooling in heterogeneous contexts (Cloud, on-prem, IT/OT constraints). * Strong experience in automation: building playbooks/workflows and automating repetitive operational tasks (triage/enrichment, routing, reporting, notifications, ticketing integration), using scripting and APIs. * Good understanding of log/telemetry concepts and correlation principles; experience with SIEM and log pipelines is a strong advantage (or strong motivation/ability to build this capability as the service scales). * Cloud exposure (Azure/AWS/GCP/sovereign) is a plus; interest or experience in OT constraints is a plus. * Cybersecurity certifications are a strong advantage (SOC/IR, cloud security, automation, etc.). Behavioral Capabilities * Autonomous and hands-on, with a strong "get-things-done" mindset in an environment that is scaling and evolving. * Strong rigor: reliable execution, structured troubleshooting, attention to detail, documentation reflex. * Automation-first mentality: naturally driven to remove manual steps, standardize, and industrialize processes to operate efficiently with a lean team. * Strong collaboration and communication skills, able to work with Business Units, local security teams, internal Cyberdefense functions and vendors/partners. * Curious, proactive and continuously learning; comfortable assessing new tools/approaches pragmatically. * Strong ethics and discretion. * Comfortable working in a multicultural, distributed team. Skills * Understanding of SOC workflows (triage, enrichment, qualification, escalation) and operational constraints. * Familiarity with EDR/SOAR concepts and workflows; exposure to SIEM/log management/correlation is a strong plus. * Automation & scripting: ability to automate via APIs and scripting (e.g., Python/PowerShell), with good practices (versioning, testing, maintainability); CI/CD and "automation as code" is a plus. * Understanding of log collection constraints, data quality, normalization, parsing, and correlation readiness. * Documentation & operationalization: ability to produce runbooks, integration guides, technical notes, and to ensure repeatable handover. * Fluent professional English in an international context. * You may be required to travel within the Equans perimeter., Join a dynamic team of passionate professionals, actively involved in prestigious cybersecurity collaboration networks. Be part of a culture that values excellence, innovation, and mutual support. ## Description Customer Cyber Defense (CCD) team, part of SLS Cyber Customer Trust (SLS CCT), is the OneITeam organization responsible for delivering detection (SOC), vulnerability management and incident response services for Equans-owned business systems (IT/OT) that support the delivery of services to Equans customers. Reporting to the Head of CCD, the CCD Engineer is responsible for the technical build-up, integration and run-ready implementation of the CCD tooling stack, with a strong focus on automation. The role covers the deployment and evolution of detection and vulnerability management capabilities (starting with CrowdStrike and SOAR enablement, and evolving towards SIEM/log correlation and potentially OT sensors), the industrialization of technical processes (ingestion, triage, playbooks, reporting), and the continuous improvement of operational efficiency to enable CCD scale-up with a small team. The position requires close collaboration with Business Units, local CCT security teams, internal Cyberdefense functions, and solution providers/partners, acting as the day-to-day technical point of contact for tooling and integrations. KEY METRICS OF THE ENVIRONMENT * Workstations: 5000 * Servers: 4000 * Hosting: 80% of the IT are managed on Azure and AWS, new Customer Landing Zones (CLZ) to come to host business systems (projects, production, etc.). These Customer Landing Zones will be operated in Azure, AWS, GCP, and potential sovereign European CSP., As a key technical contributor to CCD scale-up, the CCD Engineer is responsible for delivering and industrializing the tooling and automation foundations required to operate and expand the service efficiently with a lean team. * Tooling operations (CrowdStrike & SOAR): ensure the operational maintenance of the existing tooling stack where already deployed (CrowdStrike and SOAR), including health monitoring, upgrades, configuration management, access management, and operational readiness. * Environment onboarding: onboard new Equans-owned business systems into the CCD tooling stack by driving the technical integration end-to-end, ensuring consistent and repeatable deployments. * SOAR-first operations (automated SOC N1): build and continuously improve a SOAR-driven model where first-line activities are automated by design (triage, enrichment, first qualification, routing/assignment, notifications, evidence collection), by developing new playbooks and optimizing existing ones. * Vulnerability management automation (risk-based): industrialize and automate vulnerability workflows end-to-end, including asset/context collection enrichment with risk signals/analysis, generation of risk-based reporting, automated communications to stakeholders. * Technical roadmap execution (SIEM & beyond): contribute to and deliver the technical evolution of CCD capabilities over time, including preparation and implementation of SIEM onboarding, log correlation, additional telemetry sources (identities, Cloud, firewall, etc.), and (where relevant) OT visibility/sensing components. * CLZ readiness (Customer Landing Zones): contribute to making CCD deployable by default in new CLZ (hosting for business systems) by defining technical standards and integration patterns, and ensuring alignment with evolving CLZ building blocks. * Workflow industrialization: contribute to the lifecycle management of detection content and operational workflows (use cases, rules, playbooks), including testing, tuning, versioning and continuous optimization. * POCs and technical assessments: propose and support request for proposals and proof-of-concept activities for new tools/technologies. * Operational documentation: produce and maintain technical documentation, runbooks, integration guides and architecture notes; contribute to the internal knowledge base and ensure operational handover is repeatable. * Technical support to operations: provide technical support to analysts and stakeholders on tooling, workflows and investigations. * Provider technical interface: act as the technical point of contact for vendors/partners for integrations, troubleshooting and updates (service governance and escalation ownership remain with the Head of CCD). ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Tips and Tricks for Working with JSON](https://www.wearedevelopers.com/videos/1229-tips-and-tricks-for-working-with-json) - [Technical Documentation - How Can I Write Them Better and Why Should I Care?](https://www.wearedevelopers.com/videos/681-technical-documentation-how-can-i-write-them-better-and-why-should-i-care) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) ## Related Articles - [Best Companies to Work For in Paris: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/190-best-companies-to-work-for-in-paris-top-25-companies-in-2023) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Best Companies to Work For in France: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/189-best-companies-to-work-for-in-france-top-25-companies-in-2023) - [Where to Find Entry-Level Software Engineering Jobs](https://www.wearedevelopers.com/magazine/397-where-to-find-entry-level-software-engineering-jobs) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)