CSIRT Manager

This is a fully remote position, open to applicants in France.

📋 Description

• Lead and manage activities related to the detection, analysis, and response to security incidents.

• Enhance the maturity and breadth of the CSIRT capabilities to mitigate cyber risks and boost operational resilience.

• Ensure the efficacy, quality, and integration of tools and processes, especially those supplied by the CSIRT service provider.

• Develop and oversee the complete evolution of the detection, analysis, and incident response capabilities.

• Define the scope of coverage and refine detection use cases.

• Supervise alert monitoring, triage, and analytical processes.

• Manage incident resolution from qualification to closure, incorporating lessons learned.

• Coordinate with IT, business teams, communications, and legal departments during significant incidents.

• Organize purple team exercises, attack simulations, comprehensive tests, and business continuity/disaster recovery drills.

• Participate in the Cyber Crisis Management Team.

• Oversee the MSSP contract and relationship, including SLAs, service commitments, penalties, amendments, and renewals.

• Conduct service review meetings and monitor improvement plans.

• Challenge service quality and assist in provider selection or replacement.

• Manage the budget for the capability and optimize cost-to-value ratios.

• Define and track SOC KPIs and KRIs.

• Create dashboards for the CISO, executive management, and governance bodies.

• Ensure adherence to NIS2, DORA, ISO 27001, and GDPR regulations.

• Prepare for and assist with audits related to the capability.

⛳️ Requirements

• Education: Master’s degree (engineering school, Master’s degree in cybersecurity or computer science) or equivalent experience.

• 5 to 7 years of experience in cybersecurity, with at least 3 years in a SOC, CERT, or incident response role.

• Experience in managing service providers (MSSP, MDR, managed services) or service contracts is a significant advantage.

• Strong understanding of attack techniques, MITRE ATT&CK, and incident investigation and response processes (forensics, log analysis, malware analysis).

• Proficiency with detection technologies: SIEM, EDR/XDR, SOAR, NDR.

• Familiarity with cloud environments (Azure, AWS, GCP), networks, and systems.

• Ability to achieve results without direct authority over MSSP operators.

• Strong diplomacy and negotiation abilities.

• Composure and sound decision-making skills in crisis situations.

• Clear communication with both technical and non-technical stakeholders.

• Attention to detail, strong organizational skills, and a mindset focused on continuous improvement.

🏝️ Benefits

• €10 meal voucher on a Swile card, with 50% employer contribution.

• Profit-sharing bonus.

• 50% reimbursement for public transportation passes, or a sustainable mobility allowance for bicycle or scooter commuting.

• Access to a benefits platform providing numerous discounts.

• Additional paid leave.

• Flexible working hours.

• Company culture centered on employee well-being.

• Supportive and innovative working environment.