Team Lead, SOC

About the Role

Lead and build Mistral AI's Security Operations Center (SOC) from the ground up, establishing best-in-class security operations and driving continuous improvement in threat detection and incident response.

Responsibilities

• Establish and manage the SOC function, including vulnerability management, alerting, detection engineering, and incident response.
• Define and implement processes for SIEM/SOAR infrastructure, logging, and threat intelligence.
• Develop and tune correlation rules, detections, and incident handling procedures.
• Lead incident communications and ensure thorough documentation.
• Contribute to security tooling, automation, and integrations to enhance detection and response capabilities.
• Coordinate exercises, post-mortems, and audits to validate security coverage and resilience.
• Mentor and manage SOC engineers, shaping the team's roadmap and delegating effectively.

Requirements

• 8+ years of experience leading SOC/CSIRT functions with proven leadership capabilities.
• Hands-on experience with SIEM platforms (e.g., Elastic Security, Sekoia, Splunk) and SOAR platforms.
• Strong experience in vulnerability management (e.g., DefectDojo, Dependency-Track) and remediation workflows.
• Solid understanding of the cyber kill chain/attack lifecycle, detection engineering, and log source coverage.
• Excellent problem-solving and communication skills, with the ability to thrive in a fast-paced startup environment.
• A builder mindset: pragmatic, automation-oriented, comfortable with ambiguity and ownership.

Nice-to-Haves

• Scripting/automation skills (e.g., Python, Bash) for data pipelines and playbooks.
• Familiarity with modern infrastructure and application stacks (Linux, containers, Kubernetes, cloud), EDR/IDS/IPS.
• Exposure to compliance frameworks (ISO 27001, SOC 2) and security audits/pen-tests.
• Experience running purple team exercises and measurable detection-coverage programs.
• Ability to partner with Product/Platform teams and influence roadmaps.