01
TRCI-26-06330
[Le Mans] - SOC Analyst N2/N3 RFP-271519-1 for Covéa
Covéa is seeking an autonomous, proactive SOC Analyst to handle level 2 and 3 incidents and strengthen detection and threat-hunting activities. The role requires at least five years in a SOC, CERT, or CSIRT, complex incident investigations including cloud incidents, Splunk, and proven experience with at least two of AWS, Azure, and GCP. The work also includes threat hunting, incident reporting, detection improvements, and support for cyber crisis exercises. CERT/CSIRT background, advanced detection engineering, Purple Team experience, and relevant security certifications are differentiators; SOAR, EDR, ServiceNow, CTI platforms, and scripting are named tools or skills, but only Splunk is explicitly stated as required. The contract is based in Le Mans, with no work mode specified; the stated experience band is 5–10 years, consistent with the description’s five-year minimum.
Position summary
- Location
- France
- Workplace
- Hybrid
- Employment
- Contract
- Experience
- Minimum 5 years and Maximum 10 years
Role overview
Why This Role Matters.
Covéa is seeking an autonomous, proactive SOC Analyst to handle level 2 and 3 incidents and strengthen detection and threat-hunting activities. The role requires at least five years in a SOC, CERT, or CSIRT, complex incident investigations including cloud incidents, Splunk, and proven experience with at least two of AWS, Azure, and GCP. The work also includes threat hunting, incident reporting, detection improvements, and support for cyber crisis exercises. CERT/CSIRT background, advanced detection engineering, Purple Team experience, and relevant security certifications are differentiators; SOAR, EDR, ServiceNow, CTI platforms, and scripting are named tools or skills, but only Splunk is explicitly stated as required. The contract is based in Le Mans, with no work mode specified; the stated experience band is 5–10 years, consistent with the description’s five-year minimum.
Your Impact
Deliver Enterprise Value
Help organisations solve complex business problems through modern technology, consulting expertise and measurable outcomes.
Collaboration
Work Across Teams
Collaborate with consultants, architects, engineers and client stakeholders throughout the project lifecycle.
Growth
Learn Continuously
Gain exposure to enterprise technologies, certifications, mentoring and real-world project experience.
Career Path
Grow With Ubique
Build a long-term consulting career with opportunities to take on greater responsibility and leadership over time.
Responsibilities
What You'll Be Doing.
Every role at Ubique contributes directly to solving meaningful business challenges for our clients.
02
Cloud Investigation: Compromise analytics on AWS, Azure, and GCP; Leverage cloud logs. investigation of account breaches, abuse of privileges, lateral movements and exfiltrations; Improved cloud visibility and discovery.
03
Threat Hunting: campaigns based on CTI, MITRE ATT&CK TTP, and compromise assumptions; Proactive detection of uncovered activity; Transformation of discoveries into detection, SIEM rules, or SOAR automations.
04
Continuous improvement: evaluation of detection mechanisms, new use cases, enrichment of reflex sheets, development of the team's skills, active monitoring of threats.
05
Investigation: forensics, incident response methodologies, log analysis and correlation, MITRE ATT&CK, cyber kill chains and TTP.
06
Cloud: Proven experience on at least 2 of the 3 platforms — Azure (Activity Logs, Entra ID, Defender for Cloud), AWS (CloudTrail, GuardDuty, IAM, Security Hub), GCP (Cloud Audit Logs, Cloud IAM, Security Command Center).
07
SOC tools: Splunk (required), SOAR, EDR (Defender for Endpoint, CrowdStrike), ServiceNow, CTI platforms.
08
Scripting: Python, PowerShell, KQL, SPL (Splunk).
09
Experience: minimum 5 years in SOC/CERT/CSIRT, with complex investigations including incidents in a cloud environment.
Technology stack
Tools & Technologies.
The platforms and technologies you'll use to build modern, enterprise-grade solutions.
01
Splunk
Required
02
SPL
Required
03
SIEM
Required
04
SOAR
Required
05
EDR
Required
06
Microsoft Defender for Endpoint
Required
07
CrowdStrike
Required
08
AWS
Required
09
CloudTrail
Required
10
GuardDuty
Required
11
IAM
Required
12
Security Hub
Required
13
Azure
Required
14
Activity Logs
Required
15
Entra ID
Required
16
Defender for Cloud
Required
17
GCP
Required
18
Cloud Audit Logs
Required
19
Cloud IAM
Required
20
Security Command Center
Required
Requirements
Skills & Experience.
We value curiosity, collaboration and continuous learning. If you don't meet every requirement but believe you can make an impact, we'd still love to hear from you.
Essential
Required Qualifications
At least 5 years of experience in a SOC, CERT, or CSIRT
Level 2 and 3 incident response, including qualification, investigation, containment, eradication, and remediation
Complex technical investigations, including cloud incidents, with forensic analysis and log correlation
Proven security experience on at least two of AWS, Azure, and GCP
Splunk
Threat hunting using CTI, compromise hypotheses, and MITRE ATT&CK TTPs
Detection evaluation and improvement, including creating or refining SIEM detection use cases
Preferred
Nice to Have
CERT/CSIRT experience beyond general SOC experience
Regular threat hunting and advanced detection-rule creation
Purple Team experience
SOAR automation
EDR experience with Microsoft Defender for Endpoint or CrowdStrike
ServiceNow and CTI platform experience
Python, PowerShell, KQL, and SPL scripting
GCFA, GCIH, GCIA, SC-200, AZ-500, AWS Security Specialty, CCD, CARTP, or CRTP certification
What you'll gain
More Than Just A Job.
We're committed to helping every team member grow professionally, personally and technically while working on meaningful projects.
Global Exposure
Collaborate with international clients and multicultural teams on enterprise programmes.
Continuous Learning
Expand your expertise through mentoring, certifications and hands-on project experience.
Career Growth
Take ownership, develop leadership skills and grow your consulting career over time.
Flexible Working
Hybrid and remote collaboration designed around trust and delivering exceptional outcomes.
People First
Join a supportive culture where collaboration, respect and long-term relationships come first.
Enterprise Projects
Work on meaningful technology initiatives for leading organisations across industries.
Apply
Apply for [Le Mans] - SOC Analyst N2/N3 RFP-271519-1 for Covéa
One page, about two minutes. We only ask for what we actually need to have a first conversation.