{"id":2281918,"url":"https://alion.io/job/cloud4dev-analyste-soc-n3-profil-habilitable","title":"Analyste SOC N3 profil habilitable","company":{"id":4376851,"name":"Cloud4dev","domain":"cloud4dev.fr","url":"https://alion.io/company/cloud4dev","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"freelance","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Paris, France"],"countries":["FR"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":500,"max":550,"currency":"EUR","period":"day","gross":null,"usd_annual":154000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Ansible","optional":false},{"name":"Cortex XDR","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"DNS","optional":false},{"name":"HAProxy","optional":false},{"name":"MISP","optional":false},{"name":"OpenCTI","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"VPN","optional":false},{"name":"Wazuh","optional":false}],"status":"live","first_seen_at":"2026-10-11T10:22:20Z","employer_posted_date":null,"last_verified_at":"2026-10-11T10:22:20Z","board_verified":false,"closed_at":null,"days_open":1,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":1},"description":"Missions et responsabilités\nPrendre en charge les incidents escaladés par les niveaux N1/N2 : qualification,\ninvestigation approfondie, remédiation et retour d'expérience.\nBuild SIEM : participer à la conception et au déploiement de la plateforme SIEM\n(architecture, dimensionnement EPS, raccordement et normalisation des sources de\nlogs, parsers, tableaux de bord), jusqu'à sa mise en production.\nAdministration de l'EDR : déploiement et suivi des agents, gestion des politiques de\nprotection, exclusions et mises à jour, maintien en condition opérationnelle de la\nconsole et intégration des alertes EDR dans le SIEM.\nConcevoir, tester et maintenir les règles de corrélation et cas d'usage SIEM\n(alignement MITRE ATT&CK, réduction des faux positifs).\nAnalyser les journaux réseau et applicatifs : DNS, proxy (référent, User-Agent),\nfirewall, VPN.\nContribuer à la maîtrise des flux : règles firewall stateful, tunnels VPN, routage par\npolitique (PBR), bascule en cas de perte de tunnel.\nParticiper aux projets de migration d'outils ou d'équipements de sécurité (SIEM,\nfirewall, EDR).\nRédiger procédures, playbooks et rapports d'incident ; produire les indicateurs pour le\nRSSI.\nAccompagner et faire monter en compétences les analystes N1/N2.\nCompétences techniques requises\nDomaine \nAttendu \nExemples d'outils (CV validés)\nSIEM et détection \nIndispensable – création de règles\nde corrélation, tableaux de bord,\ntuning\nSplunk, ELK, Wazuh, Microsoft\nSentinel, Logpoint, Rapid7\nInsightIDR\nEDR / XDR / SOAR \nIndispensable – investigation et\nremédiation\nCortex XDR / XSOAR,\nSentinelOne, Microsoft Defender\nRéseau et\nprotocoles\nIndispensable – TCP/IP , modèle\nOSI (couches 3 et 4), DNS, HTTP\nAnalyse de logs, Wireshark\nFirewall et VPN \nIndispensable – stateful, IPsec,\nPBR, haute disponibilité\nPalo Alto / Panorama, Fortinet,\nStormshield\nProxy et web \nIndispensable – forward / reverse\nproxy, filtrage, analyse HTTP\nZscaler, HAProxy, Squid\nProfil recherché\nFiche de poste – Analyste SOC N3\n\nNationalité Française requise pour cette mission\nFormation : Bac+5 en cybersécurité, sécurité des systèmes et réseaux, ou équivalent.\nExpérience : 5 ans minimum en cybersécurité, dont plusieurs années en SOC (N2/N3) ;\nun parcours initial en administration systèmes et réseaux est un vrai plus.\nRéalisations attendues : construction ou industrialisation d'un SOC, mise en place de\nSIEM, création de règles de détection, réduction mesurable des faux positifs.\nCertifications appréciées : Palo Alto (PCNSE, PCNSA, Cortex XDR), éditeurs SIEM,\nCISSP , GIAC.\nSavoir-être : rigueur, autonomie, capacité de rédaction, pédagogie envers les N1/N2,\ndiscrétion (contexte administration sensible).\nGrille de préqualification technique\nCes questions sont celles posées par le client ; les éléments attendus servent à filtrer les\ncandidats avant présentation.\nDomaine \nAttendu \nExemples d'outils (CV validés)\nThreat Intel \nApprécié \nMITRE ATT&CK, OpenCTI, MISP ,\nSuricata\nSystèmes et\nannuaire\nApprécié \nActive Directory, Windows\nServer, Linux\nAutomatisation \nApprécié \nPython, PowerShell, Ansible","description_format":"text","description_chars":3066,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-11T11:56:00Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":20,"reasons":["seen:0","win:early"],"computed_at":"2026-10-12T06:55:09Z"},"pay":{"stated_usd_annual":154000,"is_top_pay":false},"html_url":"https://alion.io/job/cloud4dev-analyste-soc-n3-profil-habilitable","json_url":"https://alion.io/job/cloud4dev-analyste-soc-n3-profil-habilitable.json","meta":{"generated_at":"2026-10-12T15:35:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"assistant_verified","counted_by":"address","units_charged":1,"used_today":3394,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4376851},"rest":"https://alion.io/mcp/rest/get_company?id=4376851"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcloud4dev-analyste-soc-n3-profil-habilitable"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcloud4dev-analyste-soc-n3-profil-habilitable"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcloud4dev-analyste-soc-n3-profil-habilitable"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cloud4dev-analyste-soc-n3-profil-habilitable\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcloud4dev-analyste-soc-n3-profil-habilitable"}]}