Cybersecurity Engineer, Soc Analyst

Mistral AI Mistral AI · AI Frontier · Paris, France · Engineering & Infra

Mistral AI is seeking a Security Operations Center (SOC) Analyst to monitor, defend, and respond to threats within their AI ecosystem. The role involves treating security telemetry as core to active defense, ensuring the continuous security of IT, Engineering, Science, Compute, and Infrastructure environments by building robust detection mechanisms and enabling swift automated responses. Responsibilities include centralizing security logs, designing and tuning alert scenarios, operationalizing Cyber Threat Intelligence, investigating security alerts, and driving incident response from containment to remediation.

What you'd actually do

  1. Partner with engineering and platform teams to ensure the comprehensive centralization of security logs across all Mistral environments.
  2. Design, test, and continuously tune high-fidelity alert scenarios and correlation rules to detect anomalous behavior while minimizing alert fatigue.
  3. Operationalize Cyber Threat Intelligence (CTI), monitoring the landscape for threats specific to AI and cloud infrastructure, and integrating actionable intel directly into our detection pipelines.
  4. Conduct rigorous, deep-dive investigations into security alerts, tracking root causes, identifying potential lateral movement, and determining impact.
  5. Drive the lifecycle of security incidents from containment to remediation, and coordinate cross-functional crisis management during high-severity events.

Skills

Required

  • 3+ years of experience in a Security Operations Center (SOC), Incident Response, or Threat Hunting role
  • Deep understanding of the threat landscape, the MITRE ATT&CK framework
  • Strong experience writing complex queries (e.g., KQL, Splunk SPL, or similar) and leveraging SIEM platforms
  • Ability to write practical automation scripts in Python or Go
  • Proven experience participating in or leading incident response efforts

Nice to have

  • cloud-native or fast-paced tech environment

What the JD emphasized

  • security telemetry
  • active defense
  • detection mechanisms
  • automated response
  • security logs
  • alert scenarios
  • correlation rules
  • Cyber Threat Intelligence
  • AI and cloud infrastructure
  • security incidents
  • incident response
  • threat hunting
  • SIEM platforms
  • detection logic
  • automation scripts
  • security APIs
  • response workflows