Customer Cyber Defense Engineer (M/F/X)

1. EQUANS 

Equans is a world leader in the energy and services sector, with annual revenues of nearly €19,2 billion* and almost 800,000 projects.​ 

Equans has leading positions in Europe, which is the result of the history of energy construction in these countries, and strong presences in North and South America and in Oceania.​ 

With nearly 90,000 highly skilled employees, Equans has a strong geographic footprint, anchored by historic local brands. Equans provides its customers with excellent technical expertise in the design, installation, maintenance, and operation of multi-technical facilities. This know-how is based on key skills. First of all, in electrical and thermal engineering - two strong points that help accelerate the reduction of our clients' carbon footprint - but also in ventilation, refrigeration, mechanics and robotics, fire protection, energy renovation, digital solutions, IT, cyber security and telecommunications.​ 

The combination of thes expertises allows us to offer efficient and optimised solutions at all stages of the energy chain, from production, storage and transport to usage. 

(*) Turnover 2024 consolidated 

1. SOC ENGINEER 

SUMMARY OF THE ROLE

Customer Cyber Defense (CCD) team, part of SLS Cyber Customer Trust (SLS CCT), is the OneITeam organization responsible for delivering detection (SOC), vulnerability management and incident response services for Equans-owned business systems (IT/OT) that support the delivery of services to Equans customers. 

Reporting to the Head of CCD, the CCD Engineer is responsible for the technical build-up, integration and run-ready implementation of the CCD tooling stack, with a strong focus on automation. The role covers the deployment and evolution of detection and vulnerability management capabilities (starting with CrowdStrike and SOAR enablement, and evolving towards SIEM/log correlation and potentially OT sensors), the industrialization of technical processes (ingestion, triage, playbooks, reporting), and the continuous improvement of operational efficiency to enable CCD scale-up with a small team. 

The position requires close collaboration with Business Units, local CCT security teams, internal Cyberdefense functions, and solution providers/partners, acting as the day-to-day technical point of contact for tooling and integrations. 

KEY METRICS OF THE ENVIRONMENT 

• Hosting: 80% of the IT are managed on Azure and AWS, new Customer Landing Zones (CLZ) to come to host business systems (projects, production, etc.). These Customer Landing Zones will be operated in Azure, AWS, GCP, and potential sovereign European CSP. 

• Teammates: 4,5 FTE in Customer Cyber Defense team (including the Head of CCD) 

KEY RESPONSIBILITIES 

As a key technical contributor to CCD scale-up, the CCD Engineer is responsible for delivering and industrializing the tooling and automation foundations required to operate and expand the service efficiently with a lean team. 

• Tooling operations (CrowdStrike & SOAR): ensure the operational maintenance of the existing tooling stack where already deployed (CrowdStrike and SOAR), including health monitoring, upgrades, configuration management, access management, and operational readiness. 

• Environment onboarding: onboard new Equans-owned business systems into the CCD tooling stack by driving the technical integration end-to-end, ensuring consistent and repeatable deployments. 

• SOAR-first operations (automated SOC N1): build and continuously improve a SOAR-driven model where first-line activities are automated by design (triage, enrichment, first qualification, routing/assignment, notifications, evidence collection), by developing new playbooks and optimizing existing ones. 

• Vulnerability management automation (risk-based): industrialize and automate vulnerability workflows end-to-end, including asset/context collection enrichment with risk signals/analysis, generation of risk-based reporting, automated communications to stakeholders. 

• Technical roadmap execution (SIEM & beyond): contribute to and deliver the technical evolution of CCD capabilities over time, including preparation and implementation of SIEM onboarding, log correlation, additional telemetry sources (identities, Cloud, firewall, etc.), and (where relevant) OT visibility/sensing components. 

• CLZ readiness (Customer Landing Zones): contribute to making CCD deployable by default in new CLZ (hosting for business systems) by defining technical standards and integration patterns, and ensuring alignment with evolving CLZ building blocks. 

• Workflow industrialization: contribute to the lifecycle management of detection content and operational workflows (use cases, rules, playbooks), including testing, tuning, versioning and continuous optimization. 

• POCs and technical assessments: propose and support request for proposals and proof-of-concept activities for new tools/technologies. 

• Operational documentation: produce and maintain technical documentation, runbooks, integration guides and architecture notes; contribute to the internal knowledge base and ensure operational handover is repeatable. 

• Technical support to operations: provide technical support to analysts and stakeholders on tooling, workflows and investigations. 

• Provider technical interface: act as the technical point of contact for vendors/partners for integrations, troubleshooting and updates (service governance and escalation ownership remain with the Head of CCD). 

PROFILE  

Academic background & Experience  

• Master’s or Engineering degree in cybersecurity, computer science, Information Technology, software engineering, or a related field (or equivalent proven experience). 

• minimum 3 years of experience in a technical cybersecurity role, ideally in one (or a mix) of the following areas: SOC engineering, security tooling integration, automation, detection engineering, or security operations engineering. 

• Proven hands-on experience operating and evolving security tooling in production, with a focus on reliability, maintainability and scalability (configuration management, upgrades, monitoring, troubleshooting). 

• Demonstrated experience onboarding new environments to security tooling in heterogeneous contexts (Cloud, on-prem, IT/OT constraints). 

• Strong experience in automation: building playbooks/workflows and automating repetitive operational tasks (triage/enrichment, routing, reporting, notifications, ticketing integration), using scripting and APIs. 

• Good understanding of log/telemetry concepts and correlation principles; experience with SIEM and log pipelines is a strong advantage (or strong motivation/ability to build this capability as the service scales). 

• Cloud exposure (Azure/AWS/GCP/sovereign) is a plus; interest or experience in OT constraints is a plus. 

• Cybersecurity certifications are a strong advantage (SOC/IR, cloud security, automation, etc.). 

Behavioral Capabilities​ 

• Autonomous and hands-on, with a strong “get-things-done” mindset in an environment that is scaling and evolving. 

• Strong rigor: reliable execution, structured troubleshooting, attention to detail, documentation reflex. 

• Automation-first mentality: naturally driven to remove manual steps, standardize, and industrialize processes to operate efficiently with a lean team. 

• Strong collaboration and communication skills, able to work with Business Units, local security teams, internal Cyberdefense functions and vendors/partners. 

• Curious, proactive and continuously learning; comfortable assessing new tools/approaches pragmatically. 

• Strong ethics and discretion. 

• Comfortable working in a multicultural, distributed team. 

Skills 

• Understanding of SOC workflows (triage, enrichment, qualification, escalation) and operational constraints. 

• Familiarity with EDR/SOAR concepts and workflows; exposure to SIEM/log management/correlation is a strong plus. 

• Automation & scripting: ability to automate via APIs and scripting (e.g., Python/PowerShell), with good practices (versioning, testing, maintainability); CI/CD and “automation as code” is a plus. 

• Understanding of log collection constraints, data quality, normalization, parsing, and correlation readiness. 

• Documentation & operationalization: ability to produce runbooks, integration guides, technical notes, and to ensure repeatable handover. 

• Fluent professional English in an international context. 

• You may be required to travel within the Equans perimeter.  

WHY JOIN US? 

Motivational environment 

Join a dynamic team of passionate professionals, actively involved in prestigious cybersecurity collaboration networks. Be part of a culture that values excellence, innovation, and mutual support. 

High impact 

Group CIO–sponsored initiative, regularly reported at Group Comex level: high visibility, strong impact, and direct alignment with the SLS CCT Director and the Group CISO. 

Platform in the making 

Help build the automation backbone that makes CCD scalable: SOAR-driven N1, playbooks, automated enrichment, and automated risk-based reporting. Your work will turn security operations into repeatable “automation building blocks” that can be rolled out consistently across environments. 

Scale-up mindset 

CCD is rolling out. You will help it gain speed: expand coverage, keep the platform stable, and make automation do the heavy lifting. The goal is simple: more environments protected, less manual work, every month. 

by

CSIRT Analyst (M/F/X)

EQUANS

Equans is a world leader in the energy and services sector, with annual revenues of nearly €19,2 billion* and almost 800,000 projects.​

Equans has leading positions in Europe, which is the result of the history of energy construction in these countries, and strong presences in North and South America and in Oceania.​

With nearly 90,000 highly skilled employees, Equans has a strong geographic footprint, anchored by historic local brands. Equans provides its customers with excellent technical expertise in the design, installation, maintenance, and operation of multi-technical facilities. This know-how is based on key skills. First of all, in electrical and thermal engineering - two strong points that help accelerate the reduction of our clients' carbon footprint - but also in ventilation, refrigeration, mechanics and robotics, fire protection, energy renovation, digital solutions, IT, cyber security and telecommunications.​

The combination of thes expertises allows us to offer efficient and optimised solutions at all stages of the energy chain, from production, storage and transport to usage.

(*) Turnover 2024 consolidated

CSIRT analyst (F/M/X)

Summary of the role

Within the CSIRT of Equans, you ensure the initial detection, preliminary assessment and response to IT security incidents.

By examining the technical data collected, you identify the attackers' modus operandi, determine their objectives and evaluate the extent of the attacks in order in particular to search within the environment for elements that could indicate a potential compromise.

Through an investigation report, you offer recommendations to resolve problems and strengthen the security of affected systems. You suggest actions to take to thwart and resolve the incident, including cleaning and strengthening the security of affected systems.

You carry out constant monitoring of new vulnerabilities, emerging technologies and attack methods linked to system components, by developing appropriate investigation tools.

KEY METRICS OF THE ENVIRONMENT

• Identities managed: 95,000
• Workstations: 60000
• Servers: 6500
• Hosting: 80% of the IT are managed on Azure and AWS
• Teammates: 4 in France for a total of 17 people in the CSIRT (3 incident handlers in Montreal CA)
• Knowledge and toolings:
  • Must know KQL queries
  • Use of EDR solutions
  • Good knowledge of Microsoft security solutions
  • Good knowlegde of Cloud environments
  • knowledge of Threat Intelligence platform solution
  • Use of SIRP
  • Use of Feedly for cyber watch

KEY OBJECTIVES & KPIs

• Leading at least 3 campaigns to improve our overall detection (Defining audit logs, assist Cyberdefense architects for data collection and parsing, identifying risks, use cases and associated detection rules, build incident responses);
• Carrying out structured threat hunting, based on a hypothesis, in order to identify weak signals within our environment;
• Producing every month an internal threat report for a specific Business Unit;
• Animating public and corporate events to improve our overall visibility and share our insights with other teams;
• Creating playbooks to improve our incident response processes

KEY RESPONSIBILITIES

• Carry out structured threat hunting in order to identify weak signals within our environment;
• Enrich and integrate TTPs and indicators of compromise into monitoring tools;
• Produce actionable reports based on threat intelligence data;
• Perform real-time incident response in order to participate in the whole lifecycle of the incident (identification and monitoring of the attack path, collection of artifacts for forensic analysis, threat analysis and remediation actions);
• Propose new rules and means to be implemented to improve our overall detection;
• Participate in intrusion tests and red team missions;
• Be a major actor in the development of the threat intelligence platform;
• Introduce information related to cybersecurity to improve awareness and implementation of security practices;
• Develop and maintain relationships with experts or organizations that can help or participate in the CSIRT’s mission;
• Continuously improve the service provided and report to the CSIRT manager;
• Support the CSIRT manager in the preparation of committees

In conjunction with Equans  internal teams and partner teams:

• Inform management of suspected incidents and explain the history by providing punctual feedback with the status and potential impact of the event;
• Provide advice on disaster recovery, emergency and business continuity plans, at the tactical, operational and strategic levels;
• Recommend measures to circumvent and remediate the incident.

PROFILE

Academic background & Experience

Engineering degree (Master’s level or equivalent) in computer science, cybersecurity, information sciences, or a related field. Specialization in Threat Intelligence, threat analysis, or offensive security (e.g., via a Master’s in cybersecurity or certifying programs from ENISA or Romanian universities such as the Polytechnic University of Bucharest) would be a major asset. Continuous training in cybersecurity (MOOCs, bootcamps) is appreciated to demonstrate ongoing skill updates.

At least 3 years of experience in a similar cybersecurity role, ideally within a CSIRT, SOC, or Threat Intelligence team. Proven expertise in Threat Intelligence is essential: you must have hands-on experience in monitoring and analyzing TTPs of cyber threat actors, enriching IoC, and producing actionable reports based on intelligence data.

Behavioral Capabilities​

• Strong leadership skills
• Excellent problem-solving and analytical skills, with the ability to troubleshoot complex access governance issues and implement effective solutions.​
• Ability to communicate effectively with both technical and non-technical stakeholders, ensuring clarity in explaining complex technical concepts.​
• Strong collaboration skills, working seamlessly with cross-functional teams such as IT, security, and compliance.
• You demonstrate interest and skills in developing task automation
• Good communicator, you have interpersonal skills and you adapt easily to various people;
• You have a sense of ethics, and know how to exercise discretion;
• You are fluent in English and willing to work in an international context.​
• Comfortable working in a multicultural, distributed team.
• You have an excellent methodological approach to managing incident responses; 

Skills

• You have technical background demonstrating the ability to perform the assigned tasks;
• You are autonomous, technically versatile and have the ability to tackle new and stimulating technical subjects;
• You master monitoring and intrusion detection tools, as well as incident management systems;
• You are competent in static malware analysis;
• You have one or more certifications related to incident response (SANS, OSCP, etc.) and possibly cyber threat intelligence are desirable.

Why Join Us?

Motivational Environment
Join a dynamic team of passionate professionals, actively involved in prestigious cybersecurity collaboration networks. Be part of a culture that values excellence, innovation, and mutual support.

Challenging Topics
Contribute to multiple high-impact projects that tackle real-world cybersecurity challenges. Your expertise will make a difference.

Empowered Voices
Your ideas matter. As a valued team member, your input will be heard, respected, and considered in decision-making processes.

Technical Growth
Advance your skills through tailored training programs and hands-on experience. We invest in your development to help you reach your full potential.

by

Cybersecurity Architect - SLS Cyber Customer Trust (M/F/X)

As part of its new organization and the global challenges in the field of cybersecurity, the IT Department of EQUANS is looking for :

SLS Cyber Customer Trust Architect (M/F/X)

Location : any

Within the EQUANS IT department, you will be part of the Cyber Customer Trust team, that helps the EQUANS business units delivering cyber secure solutions to their customers.

This team is led by the Cyber Customer Trust director and is reporting to the Global CISO.

As the Architect in the Shared Line of Service (SLS) Cyber Customer Trust, you will mainly be tasked with assessing the cybersecurity in architectures of products created by the Equans Business Units, as well as providing global support to local cyber teams responsible for securing the service offerings of their businesses, including digital and OT. This can also include in globalizing a local product for EQUANS world wide usage. For example, assessing an existing architecture on cybersecurity aspects and advising the Business Unit on improvements. An other example: to better protect our clients' operations and data, you are involved in assisting in designing secure architectures for their applications or proposing a sustainable security plan for their projects.

In this context, your main missions and activities will include:

• Assess architectures from existing and new products from the Business Units on cybersecurity aspects and advise (and track) Business Units in any improvements.
• Define cyber guidelines and policies related to service offerings including Digital and OT delivered to our clients.
• Responsible for designing and maintaining our standardized security solutions that will enable our operational staff to conduct their activities with and be compliant to EQUANS policies.
• Develop and maintain a catalog of cyber solutions, products, and partners that can be integrated into the commercial offers including Digital and OT.
• When needed, participate in the writing of cyber offers and supporting local cyber teams, in case local skills and knowledge are absent. This includes participating in the Bid, Design and Acceptance phases of projects. These activities also demonstrate the added value of cyber activities from the launch of the SLS.
• Participate in Technology Watch to spot solutions, trends and innovations, that can be used by the EQUANS business to deliver secure solutions to EQUANS customers.
• Participate in Regulatory Watch to monitor regulations for any impact on the CCT activities or impact the EQUANS solutions used for EQUANS customers.
• Participate in a Vulnerability Disclosure Program for EQUANS developed Products, to improve security and comply with legislation (NIS2, CRA).

Your profile:

• You have a higher education degree (an Engineering degree in cybersecurity or a master's degree in computer science and networks) or a proven experience as a OT Security Consultant;
• You are recognized for your expertise in securing systems, with ideally some related certifications (CISSP, CEH, CompTIA Security+ or GSEC) or certifications from main security solutions related to the OT environment;
• You have a good understanding of our clients' business challenges;
• Knowledge of security information frameworks and risk management is useful (IEC 62443, ISO 27001, 27002, 27005);
• You are comfortable working in a decentralized and multicultural organization, with heterogenous maturity levels in terms of cybersecurity and architecture practices;
• You can act as a consultant for the internal EQUANS business;
• You are autonomous, energetic and show initiative;
• You are a good communicator, develop and maintain good relationships;
• You have strong ethics, and can exercise discretion;
• You are fluent in English

by

Risk & Compliance Analyst - SLS Cyber Customer Trust (M/F/X)

As part of its new organization and the global challenges in the field of cybersecurity, the IT Department of EQUANS is looking for:

SLS Cyber Customer Trust Risk & Compliance Analyst (M/F/X)

Location : any

Within the EQUANS IT department, you will be part of the Cyber Customer Trust team, that helps the EQUANS business units delivering cyber secure solutions to their customers.

This team is led by the Cyber Customer Trust director and is reporting to the Global CISO.

As a Risk & Compliance Analyst in the Shared Line of Service (SLS) Cyber Customer Trust, you will be tasked with providing global support to local cyber teams responsible for securing the service offerings of their businesses, including digital and OT. For example, to better protect our clients' operations and data, this may involve analysing the risks that apply on their projects with Equans and proposing sustainable security plans for their projects.

In this context, your main missions and activities will include:

• Conduct risk assessments on these projects/bids/contracts to identify possible risks for the EQUANS business and for the customers. This includes advising business units in improving the used solutions, and provide recommendations for them to improve their cybersecurity level.
• Conduct risk assessments on vendors and third-party products, check for compliance and assist in creating a catalog of approved vendors and OT-products.
• Build and maintain awareness material to explain the role of the CCT team and the growing importance of laws, directives and regulations in the cyber landscape (NIS2, CRA, etc.).
• Be the evangelist of the created awareness material in the different Business Units.
• Help maintaining the inventory of ongoing projects/bids between EQUANS and its clients that involve digital solutions.
• Help with the audit and compliance checks done by the other CCT risk assessors (technical audits, configuration reviews, etc.) on products, bids and contracts with the support of internal or external experts (pentesters, legal teams, etc.).

Your profile:

• You have a higher education degree (an Engineering degree in cybersecurity or a Master’s degree in Computer Science and networks) or a proven experience in governance, risk and compliance (more than 3 years) ;
• You have a good knowledge of security information frameworks and risk management (ISO/IEC 27001, 27002 et 27005, NIST, EBIOS,…);
• You have basic knowledge of the current EU regulations (CRA, NIS2, DORA) and their stakes, and want to deep-dive to help our businesses become compliant;
• You have a good understanding of our clients' business challenges;
• You are comfortable working in a decentralized and multicultural organization, with heterogenous maturity levels in terms of cybersecurity and architecture practices;
• You are autonomous, energetic and show initiative;
• You are a good communicator, develop and maintain good relationships;
• You have strong ethics, and can exercise discretion;
• You are fluent in English.

by