Lead Automation (F/M/X)

EQUANS

Equans is a world leader in the energy and services sector, with annual revenues of nearly €19,2 billion* and almost 800,000 projects.​

Equans has leading positions in Europe, which is the result of the history of energy construction in these countries, and strong presences in North and South America and in Oceania.​

With nearly 90,000 highly skilled employees, Equans has a strong geographic footprint, anchored by historic local brands. Equans provides its customers with excellent technical expertise in the design, installation, maintenance, and operation of multi-technical facilities. This know-how is based on key skills. First of all, in electrical and thermal engineering - two strong points that help accelerate the reduction of our clients' carbon footprint - but also in ventilation, refrigeration, mechanics and robotics, fire protection, energy renovation, digital solutions, IT, cyber security and telecommunications.​

The combination of thes expertises allows us to offer efficient and optimised solutions at all stages of the energy chain, from production, storage and transport to usage.

(*) Turnover 2024 consolidated

Automation Lead (F/M/X)

Summary of the role

As the CyberSecurity Automation Team Lead within the Equans CSIRT, you will lead the design, development, and continuous improvement of the CSIRT cybersecurity automation and detection capabilities. This automation service is provided to the entire SLS CyberDefense ranging from Incident Handler to Vulnerability management.

You will manage a team of automation engineers while remaining strongly hands-on, contributing directly to the development of automated workflows, integrations, and detection use cases. Acting as both a technical expert and team leader, you will coordinate with cyber defence analysts, incident handlers, and other SLS CyberDefense functions to identify automation opportunities, translate operational needs into SOAR workflow, and continuously improve detection and response capabilities.

In parallel, you will lead and mentor a team of automation engineers, organize workload and priorities, and foster a culture of collaboration, innovation, and technical excellence. You will act as the primary point of contact for automation topics, interfacing with internal stakeholders and reporting to the Head of CSIRT on project progress, challenges, and strategic initiatives.

KEY METRICS OF THE ENVIRONMENT

• Identities managed: 95,000
• Workstations: 60000
• Servers: 6500
• Hosting: 80% of the IT are managed on Azure and AWS
• Tierless CSIRT without MSSP or externalization
• Teammates: 3/4 automation specialists located in France and Romania to assist the entire SLS CyberDefense

• Knowledge and toolings:
  • Must know KQL queries and Microsoft Sentinel/Defender environment
  • Use of EDR solutions
  • Good knowledge of Incident investigation and escalation process
  • Good knowledge of Cloud environments
  • Good knowledge of SOAR Platform and Cybersecurity Automation playbooks
  • Experience with API / GraphQL and Scripting with Python
  • Knowledge of Threat Intelligence platform solution

KEY OBJECTIVES & KPIs

• Ensure effective task allocation, prioritization, and workload balance across a team of 3/4 engineers
• Deliver projects : On time / Within scope / With defined quality standards
• Enforce best practices in development, testing, and deployment
• Improve CICD Workflow to deliver and maintain detection rule across SLS CyberDefense Security tools
• Reduce analyst workload and alert fatigue through advanced automation and AI-driven processes
• Foster innovation within SLS CyberDefense, leveraging AI, orchestration, and emerging technologies
• Maintain and evolve 130+ Playbooks Operational ranging from automated Enrichment / Remediation and Processes.
• Ensure operational maintenance and pertinence of 400+ Detection Rule deployed and managed through Detection as Code Workflow.
• Integrate AI into Alert triage and Investigation support reducing alert fatigue and enhancing Equans global posture
• Dedicate time for training
• Lead technical knowledge sharing through workshops / technical meeting with the team as well as Highlight presentation to for the SLS CyberDefense

KEY RESPONSIBILITIES

Team Lead

Lead a small team of cybersecurity automation specialists (3 to 5), ensuring effective task allocation, prioritization, and workload balance:

• Provide hands-on technical leadership, supporting team members in the design, development, and troubleshooting of automation workflows and detection use cases
• Act as the primary technical reference and escalation point for complex topics related to SOAR, automation, and detection engineering
• Ensure the quality and consistency of deliverables through design reviews, code reviews, and enforcement of engineering best practices
• Mentor and support team members technical development and autonomy, with a focus on skill progression and knowledge sharing
• Organize and lead team rituals (technical meetings, workshops, knowledge sharing) to maintain alignment and foster continuous improvement
• Provide clear visibility on team activities, progress, and risks to the Head of CSIRT

Automation

• Design, develop, and maintain automation workflows and playbooks within the SOAR platform (Torq), supporting the needs of the entire SLS CyberDefense organization.
• Develop and maintain integrations with security tooling, including SIEM, EDR, Threat Intelligence platforms, ticketing systems...
• Contribute to and maintain a Detection-as-Code framework, ensuring consistency, versioning, and lifecycle management of detection rules.
• Continuously optimize and enhance existing playbooks, improving execution reliability, performance, and coverage
• Collaborate with all SLS Cyberdefense Teams to : Identify automation opportunities and translate operational needs into scalable solutions
• Integrate and operationalize AI-driven capabilities within automation workflows (e.g., alert triage, enrichment, investigation support)
• Improve and maintain CI/CD pipelines for automation content and detection rules, ensuring controlled, reliable, and traceable deployments

Detection Engineering

• Design, develop, and maintain detection use cases and rules, aligned with evolving threat landscapes and attacker tactics, techniques, and procedures (TTPs)
• Contribute to and enforce a Detection-as-Code approach, ensuring versioning, traceability, and consistency across the CyberDefense detection stack
• Validate and challenge detection requirements and proposals to ensure relevance, efficiency, and operational value
• Perform regular tuning and optimization of detection rules, reducing false positives and improving signal quality

Technical Referent / Expert

• Act as the primary technical expert in cybersecurity automation and detection engineering within the CyberDefense organization
• Provide expert guidance and decision support on complex technical topics, including architecture, tooling, and workflow design
• Review and challenge technical designs, use cases, and processes to ensure scalability, performance, and maintainability
• Support resolution of complex or critical technical issues, especially those impacting multiple systems or requiring deep expertise
• Contribute to the definition and evolution of the automation and detection strategy, in alignment with global CyberDefense objectives
• Represent the automation domain in cross-team initiatives and strategic projects, ensuring alignment with overall security architecture

PROFILE

Academic background & Experience

Candidates should hold a Bachelor’s or Master’s degree in Computer Science, Information Technology, Cybersecurity, Software Engineering, or a related field.

Relevant industry certifications (e.g., GIAC GCIA, Microsoft SC-200, SOAR certification such as Palo Alto xSOAR) are considered a strong advantage.

A solid foundation in cybersecurity fundamentals is required, including:

• Automation and orchestration principles
• Detection engineering concepts
• Incident response processes
• Scripting and development practices

Professionally, candidates should demonstrate at least 4-5 years of experience in cybersecurity, including 3+ years of hands-on experience in cybersecurity automation, detection engineering, or SOAR environments, ideally within a CSIRT or SOC.

.

Behavioral Capabilities​

• Demonstrates strong technical leadership, with the ability to guide, support, and mentor a team of cybersecurity automation engineers
• Exhibits excellent analytical and problem-solving skills, with the ability to address complex automation, detection, and integration challenges
• Communicates effectively with both technical and non-technical stakeholders, ensuring clarity and alignment on complex cybersecurity topics in an international and distributed environment
• Shows strong collaboration capabilities, working efficiently with cross-functional teams across CyberDefense (CSIRT, VOC, Engineering, and other stakeholders)
• Maintains a results-oriented mindset, focusing on delivering high-quality and scalable solutions aligned with operational and strategic objectives
• Proactive and accountable, with the ability to challenge requirements, drive improvements, and take ownership of outcomes
• Shows strong technical curiosity and continuous learning mindset

Skills

• Strong technical expertise in cybersecurity, with the ability to design, implement, and evolve automation and detection capabilities within a CyberDefense environment
• Proven experience in cybersecurity automation and orchestration, including the development of scalable workflows and integrations
• Solid understanding of security monitoring and detection ecosystems, including SIEM, EDR/XDR, Threat Intelligence platforms, and case management solutions
• Strong knowledge of detection engineering practices, including rule design, tuning, and lifecycle management within a Detection-as-Code approach
• Experience with scripting and development (e.g., Python, APIs), enabling automation, integration, and industrialization of cybersecurity processes
• Good understanding of incident response processes and operational constraints, ensuring alignment between detection, investigation, and automated response
• Ability to translate operational needs into technical solutions.
• Strong analytical and problem-solving capabilities, with a rigorous and structured approach to complex technical challenges
• Excellent communication and collaboration skills, with the ability to engage both technical and non-technical stakeholders
• Fluent in English, with the ability to operate effectively in an international context

Why Join Us?

Motivational Environment
Join a dynamic team of passionate professionals, actively involved in prestigious cybersecurity collaboration networks. Be part of a culture that values excellence, innovation, and mutual support.

Challenging Topics
Contribute to multiple high-impact projects that tackle real-world cybersecurity challenges. Your expertise will make a difference.

Empowered Voices
Your ideas matter. As a valued team member, your input will be heard, respected, and considered in decision-making processes.

Technical Growth
Advance your skills through tailored training programs and hands-on experience. We invest in your development to help you reach your full potential.

by

Cloud Security Consultant

Within the EQUANS IT department, you will be part of the Cyber Customer Trust team, that helps the EQUANS business units delivering cyber secure solutions to their customers.

This team is led by the Cyber Customer Trust director and is reporting to the Global CISO.

As the Cloud Security Consultant in the Shared Line of Service (SLS) Cyber Customer Trust (CCT), you report to the Head of Cyber Design Office and will mainly be tasked with assessing the cybersecurity of cloud architectures of products created by the Equans Business Units. Also providing global support to local cyber teams responsible for securing the service offerings of their businesses, as well as working closely with the Cyber Technical Office (CTO) team. This can also include in globalizing a local product for EQUANS world wide usage. For example, assessing an existing cloud architecture on cybersecurity aspects and advising the Business Unit on improvements. Develop and continuously improve cloud security standards and frameworks as input for the CTO CCT architect as well as the business units. Together with the OT Architect in the Cyber Design Office you form the security team in charge of security architecture frameworks and assessments in Cloud and on-prem solutions.

In this context, your main missions and activities will include:

• Provide independent security assessment reports and recommendations to Business Units and Product Owners. Track remediation actions and report status through the Cyber Customer Trust governance process and take part in the Security Architecture Review Board and support Business Units through the validation process.
• Assess architectures hosted on Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP) and hybrid/on-premises environments.
• Define cloud cyber guidelines and policies related to service offerings delivered to our clients.
• Be responsible for designing and maintaining our standardized security solutions that will enable our operational staff to conduct their activities with a good cyber posture and be compliant to EQUANS policies.
• Maintain a catalog of cyber solutions, products, and partners that can be integrated into the commercial offers.
• Review cloud-native development practices, CI/CD pipelines, infrastructure-as-code configurations and deployment patterns from a cybersecurity perspective.
• When needed, participate in the writing of cyber offers and supporting local cyber teams, in case local skills and knowledge are absent. This includes participating in the Bid, Design and Acceptance phases of projects. These activities also demonstrate the added value of cyber activities from the launch of the SLS.
• Participate in Technology Watch to spot solutions, trends and innovations, that can be used by the EQUANS business to deliver secure solutions to EQUANS customers.
• Participate in Regulatory Watch to monitor regulations in different countries where EQUANS operates for any impact on the CCT activities or impact the EQUANS solutions used for EQUANS customers, for example NIS2 and the Cyber Resilience Act (CRA).

Your profile:

• You have a higher education degree (an Engineering degree in cybersecurity or a master's degree in computer science and networks) and 5+ years of experience in cloud security, security architecture within complex enterprise environments;
• You are recognized for your expertise in reviewing systems, with ideally some related certifications (CISSP, CCSP, TOGAF Practitioner, Microsoft Azure Security, AWS Security Specialty) or certifications from main security solutions related to Cloud Architecture;
• Have of:
  • Identity & Access Management (IAM)
  • Zero Trust
  • Entra ID / Azure AD
  • Key Management and PKI
  • Cloud Security Posture Management (CSPM)
  • Container Security
  • Kubernetes
  • Infrastructure as Code
  • Security Monitoring principles
  • API Security
  • Cloud Security fundamentals in Azure / AWS / GCP
  • Threat modeling (e.g. STRIDE) and trust boundary analysis
• You have a good understanding of our clients' business challenges;
• Knowledge of security information frameworks and risk management is useful (NIST CSF, ISO 27001/2, CSA CCM, CIS Controls, ISO 27005, EBIOS RM). Familiarity with OT/ICS security concepts (IEC 62443) is considered a plus;
• You are comfortable working in a decentralized and multicultural organization, with heterogenous maturity levels in terms of cybersecurity and architecture practices;
• You can act as a consultant for the internal EQUANS business.
• You are autonomous, energetic and show initiative.
• You are a good communicator, develop and maintain good relationships.
• You have strong ethics, and can exercise discretion.
• You are fluent in English / french will be a plus but not mandatory.

by