- Company Name
- Michelin
- Job Title
- Tech Lead Incident Response (CERT/CSIRT) (F/H)
- Job Description
-
Job title: Tech Lead Incident Response (CERT/CSIRT) (F/H)
Role Summary:
Lead the cybersecurity blue team by architecting, overseeing, and enhancing incident response capabilities across a global CERT/CSIRT environment. Drive technical excellence, mentor analysts, manage critical incidents, and collaborate with red teams, security architects, and policy makers to strengthen the organization’s cyber posture.
Expectations:
- Deliver advanced incident handling and forensic expertise at the command level.
- Act as a technical reference on SIEM, Active Directory/Entra ID, EPP/EDR, forensic analysis, and reverse engineering.
- Mentor and elevate analyst skill sets across multiple regions.
- Coordinate multi‑functional remediation and root cause analyses.
- Continuously evolve detection strategies and toolsets, leveraging ML and SOAR.
Key Responsibilities:
- Technical leadership of the Blue Team, including architecture, triage, and escalation processes.
- Design, configure, and optimize SIEM solutions (Splunk, Sentinel), EPP/EDR platforms, and SOAR workflows.
- Conduct forensic investigations and reverse‑engineering assessments using tools such as Volatility, DFIR‑ORC, and open‑source utilities.
- Lead incident response plans for critical threats, coordinate cross‑team remediation, and track corrective actions.
- Perform root cause analysis and document lessons learned to reduce recurrence.
- Evaluate and refine detection capabilities, ensuring timely identification of emerging threats.
- Collaborate with security architects on policy definition and with the red team on threat modeling.
- Maintain continuous threat intelligence, contribute to external communities, and disseminate best practices internally.
- Facilitate training sessions, workshops, and technical knowledge sharing.
Required Skills:
- Proficiency in SIEM platforms (Splunk – SPL, Sentinel) and SOAR integration.
- Deep knowledge of EPP/EDR tools (Microsoft Defender, Palo Alto Cortex XDR, Trend Micro Deep Security).
- Advanced digital forensic and reverse engineering capabilities (Volatility, DFIR‑ORC, Python, PowerShell).
- Network security experience (Palo Alto GlobalProtect, IDS/IPS, VPN, Wireshark).
- Strong scripting skills in PowerShell, Python, and Bash on Windows/Linux.
- Incident response and crisis management, including root cause analysis and remediation coordination.
- Strategic thinking, policy advocacy, and threat intelligence synthesis.
- Excellent communication, teamwork, initiative, autonomy, and continuous learning mindset.
- Bilingual proficiency in French and English (minimum B2).
Required Education & Certifications:
- Master's level (Bac+5) in Computer Engineering or Security, or equivalent.
- Minimum 4 years of experience in incident handling, digital forensics, and/or reverse engineering.
- Relevant security certifications preferred (CISSP, GCFA, GCIH, OSCP).