- Company Name
- TotalEnergies
- Job Title
- Analyste SOC H/F
- Job Description
-
**Job title**
SOC Analyst
**Role Summary**
Operate and manage daily security operations in a SOC, investigate and respond to incidents, coordinate incident response, and continuously improve detection capabilities. Provide expert analysis of security events, root‑cause investigations, and technical guidance for incident mitigation.
**Expectations**
- Deliver timely, accurate incident assessment and response.
- Maintain high detection accuracy and minimal false positives.
- Lead incident management and communication with stakeholders.
- Keep detection rules and monitoring coverage up‑to‑date with evolving threats.
**Key Responsibilities**
- Monitor, triage, and qualify security alerts from heterogeneous sensors.
- Conduct detailed event analysis, including log review and forensic investigation.
- Initiate and coordinate incident response actions, including containment and remediation.
- Serve as Incident Manager during incidents, managing risk and escalation.
- Report incident status to SOC leadership and CISO during and outside working hours.
- Execute delegated actions to neutralise compromised workstations.
- Facilitate incident status meetings with impacted business units.
- Identify patient‑zero and root‑cause of compromise.
- Propose preventive controls and post‑incident lessons.
- Operate advanced detection and response tools (EDR/XDR, threat‑intel platforms).
- Develop and refine detection rules, queries, and playbooks for suspicious behaviors.
- Ensure effective event collection and correlation across the security stack.
- Conduct ongoing threat‑intelligence and technology watch.
- Evaluate and validate new detection solutions, including testing and operational assessment.
- Advise on security posture for IT projects, validating detection coverage and rule relevance.
- Maintain detection perimeter, update rules, and recommend improvements.
- Collaborate with the CERT to incorporate vulnerability findings and audit results into detection strategy.
**Required Skills**
- 5+ years operational cyber‑security experience, with incident‑management focus.
- Deep understanding of cyber‑attack mechanisms, compromise indicators, and threat‑lifecycle.
- Proficiency in network protocols, architecture, and log‑analysis techniques.
- Advanced knowledge of EDR/XDR solutions (Microsoft Defender for Endpoint, Cybereason, etc.) and SIEM tools.
- Strong forensic and investigative skills using system logs, network traces, and endpoint data.
- Ability to write detection rules, queries, and response playbooks.
- Excellent communication and coordination with technical and non‑technical stakeholders.
- Continuous learning mindset, staying current on attack trends, detection technologies, and security tooling.
**Required Education & Certifications**
- Bachelor’s or Master’s degree (Bac+5) in Computer Science, Information Systems, IT Infrastructure, Networking, or Cyber‑Security.
- Equivalent practical hacking or penetration‑testing experience is acceptable.
- Relevant certifications highly preferred: CISSP, CISM, GCIH, GCIA, CEH, or vendor‑specific (Microsoft Security, Cybereason, Splunk, etc.).