09/09/2026 updated
MP
100 % available
Senior Cyber Defence Consultant | SOC/CSIRT Lead | Incident Response & Detection Engineering
Sartrouville, France
Only remote
French Bac+2 in Systems and Networks, Webforce 3 (2018-2019)About me
Seven years in cyber defence, from SOC analysis to SOC/CSIRT leadership. I help teams investigate incidents, improve detection and automate response. Available immediately, based in France. English: working proficiency.
Incident ResponseSplunkSecurity Orchestration, Automation & Response
Cyber defence professional with seven years of experience, progressing from SOC L1/L2 analysis to SOC/CSIRT leadership and independent consulting.
Incident response and investigations: L3 investigations into exfiltration, phishing and data leaks; Falcon forensics with a judicial officer; incident coordination, containment playbooks and post-incident improvement.
Detection engineering and threat hunting: Cortex XSIAM/XDR parsing, tuning and hunting; QRadar, Splunk and Wazuh. Current independent work includes 107 detection rules for the aeronautics sector. At Idemia, led the build of 40 rules covering APT36/APT28, DLP, exfiltration and Punycode.
SOC/CSIRT operations and management: daily operations, analyst training, coordination of internal teams and service providers, SLA/KPI reporting, technical and steering committees. Established a SOC at Selceon and created 20 Wazuh use cases.
Automation and integration: SOAR queries and custom field mapping, XSOAR, Splunk Phantom, TheHive, Sekoia/Cortex APIs, Power Automate, ServiceNow and Python for MITRE ATT&CK mapping.
AI in cybersecurity: evaluation and implementation of local AI solutions and a generative AI roadmap for SOC services.
Available immediately. Remote work from France; local on-site work can be discussed within 70 minutes each way by public transport from Sartrouville. English working proficiency. French fluent.
Experience
Professional experience5 - 10 years
Freelancer since2025
Languages
EnglishGoodFrenchFluent
Project history
Evaluating and benchmarking security solutions, scoping and estimating project costs. Implementing local AI solutions, performing parsing, threat hunting and tuning in Cortex XSIAM. Mapping custom fields, developing SOAR queries and building 107 detection rules for the aeronautics sector.
Led daily SOC operations with 3 internal analysts within a team of 10 alongside 15 external service providers. Trained L2 analysts and tracked objectives. Ran technical and operational governance with Orange Cyberdefense. Led the build of 40 detection rules covering APT36/APT28, DLP, exfiltration and Punycode; delivered 10 security proofs of concept. Integrated Sekoia/Cortex APIs, migrated TheHive to the cloud, mapped MITRE ATT&CK coverage in Python and managed endpoint security policies. Built incident response, isolation and Active Directory blocking playbooks; automated workflows with Power Automate and created Cortex XDR dashboards. Conducted L3 investigations into exfiltration, phishing and data leaks; performed Falcon forensics with a judicial officer and managed incidents with Microsoft US.
Established the SOC, service agreements and incident workflows; managed the crisis for PKF following the Coaxis cyberattack. Managed, recruited and trained apprentices; presented operational reviews (SLAs/KPIs) and the roadmap to the executive committee. Created 20 Wazuh use cases, introduced Scrum practices, developed a generative AI roadmap and proposed three SOC service models. Won the Carbon Black Threat Hunter Challenge CTF in Paris.