- Company Name
- LabSoft
- Job Title
- Ingénieur Cybersécurité / Détection et Analyse d'Incidents (SIEM/SOC) H/F
- Job Description
-
**Job title**
Cybersecurity Engineer – Detection & Incident Analysis (SIEM/SOC)
**Role Summary**
The role is a full‑time engineer positioned within an international SOC, responsible for the continuous operation and evolution of security detection capabilities. Duties span both RUN activities (day‑to‑day maintenance, tuning, and reporting) and BUILD tasks (development of new correlation rules, parsers, and validation of detection logic). The engineer collaborates closely with SOC operators, incident response teams, and external stakeholders to improve detection accuracy and reduce false positives.
**Expectations**
- Maintain, refine, and expand SIEM detection rules and dashboards.
- Analyze SIEM alerts, logs, and incidents, identify false positives, and propose adjustments.
- Update asset inventory and enrich event context for improved threat visibility.
- Draft patch deployment procedures and quality control checks for detection changes.
- Conduct rule development, parser design, and validation campaigns, including simulated attacks.
- Investigate advanced attack simulations, classify false positives/negatives, and support SOC operators.
- Deliver structured reports on anomalies, test results, and improvement recommendations to technical teams.
**Key Responsibilities**
- Daily management and optimization of SIEM detection pipeline (QRadar).
- Rule tuning, correlation refinement, and dashboard maintenance.
- Asset inventory management and event contextualization enhancement.
- Creation and implementation of new detection rules and IOC signatures.
- Design or adapt parsers for better flow and event interpretation.
- Execute validation and testing campaigns (simulation of attacks, detection verification).
- Produce detailed documentation and reporting on detection performance and improvements.
- Provide technical guidance to SOC operators and assist in incident investigations.
- Participate in continuous improvement initiatives for defense and monitoring tools.
**Required Skills**
- 2–5 years of professional SOC or blue‑team experience.
- Proficiency with SIEM platforms, preferably IBM QRadar.
- Strong understanding of log analysis, correlation logic, and network traffic flows.
- Experience with rule development, parser scripting, and dashboard configuration.
- Ability to analyze alerts, identify false positives/negatives, and recommend tuning.
- Familiarity with JIRA or similar ticketing/issue tracking systems.
- Fluent in professional English (written and spoken).
- Analytical mindset, technical curiosity, meticulousness, and teamwork in an agile environment.
**Required Education & Certifications**
- Bachelor’s degree (Bac+5 or equivalent) in Cybersecurity, Computer Science, Systems, or Networks.
- Relevant certifications preferred (e.g., CompTIA Security+, GIAC Security Essentials, or similarly recognized security credentials).
---