Lead Automation (Cybersecurity)

Location: 92400 Courbevoie, France

Company

Equans is a large energy and services group providing multi-technical solutions across energy, digital, IT, cybersecurity, telecommunications, and related engineering domains.

What you will do

• Lead a team of 3–5 cybersecurity automation specialists, allocating work, setting priorities, mentoring engineers, and reporting progress and risks to the Head of CSIRT.
• Design, develop, maintain, and optimize SOAR workflows and playbooks in Torq, including integrations with SIEM, EDR, threat intelligence, and ticketing platforms.
• Develop and maintain Detection-as-Code capabilities, detection rules, versioning, lifecycle management, and CI/CD pipelines.
• Design and tune detection use cases aligned with evolving threats, reducing false positives and improving signal quality.
• Integrate AI-driven alert triage, enrichment, and investigation support to reduce analyst workload and alert fatigue.
• Act as the technical reference for cybersecurity automation and detection engineering, reviewing designs and supporting complex technical issues across CyberDefense.

Requirements

• Bachelor’s or Master’s degree in Computer Science, Information Technology, Cybersecurity, Software Engineering, or a related field.
• At least 4–5 years of cybersecurity experience, including 3+ years of hands-on experience in cybersecurity automation, detection engineering, or SOAR environments, ideally within a CSIRT or SOC.
• Solid knowledge of automation and orchestration, detection engineering, incident response, scripting, and development practices.
• Experience with KQL, Microsoft Sentinel, Microsoft Defender, EDR/XDR, cloud environments, SOAR platforms, cybersecurity playbooks, and threat intelligence platforms.
• Experience with Python scripting, APIs, GraphQL, security tooling integrations, and scalable workflow development.
• Strong knowledge of detection rule design, tuning, lifecycle management, and Detection-as-Code practices.
• Strong technical leadership, analytical and problem-solving skills, ownership, collaboration, and communication with technical and non-technical stakeholders.
• Ability to translate operational needs into scalable technical solutions and work effectively in an international, distributed environment.
• Fluent English required.

Nice to have

• Relevant certifications such as GIAC GCIA, Microsoft SC-200, or a SOAR certification such as Palo Alto xSOAR.

Culture & Benefits

• Work with a CyberDefense organization supporting 95,000 identities, 60,000 workstations, 6,500 servers, and Azure and AWS environments.
• Join a tierless CSIRT without MSSP or externalization, with automation specialists located in France and Romania.
• Access training, technical workshops, knowledge-sharing sessions, and tailored professional development.
• Work on high-impact cybersecurity challenges in a culture focused on excellence, innovation, collaboration, and mutual support.