EQUANS

Equans is a world leader in the energy and services sector, with annual revenues of nearly €19,2 billion* and almost 800,000 projects.​

Equans has leading positions in Europe, which is the result of the history of energy construction in these countries, and strong presences in North and South America and in Oceania.​

With nearly 90,000 highly skilled employees, Equans has a strong geographic footprint, anchored by historic local brands. Equans provides its customers with excellent technical expertise in the design, installation, maintenance, and operation of multi-technical facilities. This know-how is based on key skills. First of all, in electrical and thermal engineering - two strong points that help accelerate the reduction of our clients' carbon footprint - but also in ventilation, refrigeration, mechanics and robotics, fire protection, energy renovation, digital solutions, IT, cyber security and telecommunications.​

The combination of thes expertises allows us to offer efficient and optimised solutions at all stages of the energy chain, from production, storage and transport to usage.

(*) Turnover 2024 consolidated

Automation Lead (F/M/X)

Summary of the role

As the CyberSecurity Automation Team Lead within the Equans CSIRT, you will lead the design, development, and continuous improvement of the CSIRT cybersecurity automation and detection capabilities. This automation service is provided to the entire SLS CyberDefense ranging from Incident Handler to Vulnerability management.

You will manage a team of automation engineers while remaining strongly hands-on, contributing directly to the development of automated workflows, integrations, and detection use cases. Acting as both a technical expert and team leader, you will coordinate with cyber defence analysts, incident handlers, and other SLS CyberDefense functions to identify automation opportunities, translate operational needs into SOAR workflow, and continuously improve detection and response capabilities.

In parallel, you will lead and mentor a team of automation engineers, organize workload and priorities, and foster a culture of collaboration, innovation, and technical excellence. You will act as the primary point of contact for automation topics, interfacing with internal stakeholders and reporting to the Head of CSIRT on project progress, challenges, and strategic initiatives.

KEY METRICS OF THE ENVIRONMENT

• Identities managed: 95,000
• Workstations: 60000
• Servers: 6500
• Hosting: 80% of the IT are managed on Azure and AWS
• Tierless CSIRT without MSSP or externalization
• Teammates: 3/4 automation specialists located in France and Romania to assist the entire SLS CyberDefense

• Knowledge and toolings:
  • Must know KQL queries and Microsoft Sentinel/Defender environment
  • Use of EDR solutions
  • Good knowledge of Incident investigation and escalation process
  • Good knowledge of Cloud environments
  • Good knowledge of SOAR Platform and Cybersecurity Automation playbooks
  • Experience with API / GraphQL and Scripting with Python
  • Knowledge of Threat Intelligence platform solution

KEY OBJECTIVES & KPIs

• Ensure effective task allocation, prioritization, and workload balance across a team of 3/4 engineers
• Deliver projects : On time / Within scope / With defined quality standards
• Enforce best practices in development, testing, and deployment
• Improve CICD Workflow to deliver and maintain detection rule across SLS CyberDefense Security tools
• Reduce analyst workload and alert fatigue through advanced automation and AI-driven processes
• Foster innovation within SLS CyberDefense, leveraging AI, orchestration, and emerging technologies
• Maintain and evolve 130+ Playbooks Operational ranging from automated Enrichment / Remediation and Processes.
• Ensure operational maintenance and pertinence of 400+ Detection Rule deployed and managed through Detection as Code Workflow.
• Integrate AI into Alert triage and Investigation support reducing alert fatigue and enhancing Equans global posture
• Dedicate time for training
• Lead technical knowledge sharing through workshops / technical meeting with the team as well as Highlight presentation to for the SLS CyberDefense

KEY RESPONSIBILITIES

Team Lead

Lead a small team of cybersecurity automation specialists (3 to 5), ensuring effective task allocation, prioritization, and workload balance:

• Provide hands-on technical leadership, supporting team members in the design, development, and troubleshooting of automation workflows and detection use cases
• Act as the primary technical reference and escalation point for complex topics related to SOAR, automation, and detection engineering
• Ensure the quality and consistency of deliverables through design reviews, code reviews, and enforcement of engineering best practices
• Mentor and support team members technical development and autonomy, with a focus on skill progression and knowledge sharing
• Organize and lead team rituals (technical meetings, workshops, knowledge sharing) to maintain alignment and foster continuous improvement
• Provide clear visibility on team activities, progress, and risks to the Head of CSIRT

Automation

• Design, develop, and maintain automation workflows and playbooks within the SOAR platform (Torq), supporting the needs of the entire SLS CyberDefense organization.
• Develop and maintain integrations with security tooling, including SIEM, EDR, Threat Intelligence platforms, ticketing systems...
• Contribute to and maintain a Detection-as-Code framework, ensuring consistency, versioning, and lifecycle management of detection rules.
• Continuously optimize and enhance existing playbooks, improving execution reliability, performance, and coverage
• Collaborate with all SLS Cyberdefense Teams to : Identify automation opportunities and translate operational needs into scalable solutions
• Integrate and operationalize AI-driven capabilities within automation workflows (e.g., alert triage, enrichment, investigation support)
• Improve and maintain CI/CD pipelines for automation content and detection rules, ensuring controlled, reliable, and traceable deployments

Detection Engineering

• Design, develop, and maintain detection use cases and rules, aligned with evolving threat landscapes and attacker tactics, techniques, and procedures (TTPs)
• Contribute to and enforce a Detection-as-Code approach, ensuring versioning, traceability, and consistency across the CyberDefense detection stack
• Validate and challenge detection requirements and proposals to ensure relevance, efficiency, and operational value
• Perform regular tuning and optimization of detection rules, reducing false positives and improving signal quality

Technical Referent / Expert

• Act as the primary technical expert in cybersecurity automation and detection engineering within the CyberDefense organization
• Provide expert guidance and decision support on complex technical topics, including architecture, tooling, and workflow design
• Review and challenge technical designs, use cases, and processes to ensure scalability, performance, and maintainability
• Support resolution of complex or critical technical issues, especially those impacting multiple systems or requiring deep expertise
• Contribute to the definition and evolution of the automation and detection strategy, in alignment with global CyberDefense objectives
• Represent the automation domain in cross-team initiatives and strategic projects, ensuring alignment with overall security architecture

PROFILE

Academic background & Experience

Candidates should hold a Bachelor’s or Master’s degree in Computer Science, Information Technology, Cybersecurity, Software Engineering, or a related field.

Relevant industry certifications (e.g., GIAC GCIA, Microsoft SC-200, SOAR certification such as Palo Alto xSOAR) are considered a strong advantage.

A solid foundation in cybersecurity fundamentals is required, including:

• Automation and orchestration principles
• Detection engineering concepts
• Incident response processes
• Scripting and development practices

Professionally, candidates should demonstrate at least 4-5 years of experience in cybersecurity, including 3+ years of hands-on experience in cybersecurity automation, detection engineering, or SOAR environments, ideally within a CSIRT or SOC.

.

Behavioral Capabilities​

• Demonstrates strong technical leadership, with the ability to guide, support, and mentor a team of cybersecurity automation engineers
• Exhibits excellent analytical and problem-solving skills, with the ability to address complex automation, detection, and integration challenges
• Communicates effectively with both technical and non-technical stakeholders, ensuring clarity and alignment on complex cybersecurity topics in an international and distributed environment
• Shows strong collaboration capabilities, working efficiently with cross-functional teams across CyberDefense (CSIRT, VOC, Engineering, and other stakeholders)
• Maintains a results-oriented mindset, focusing on delivering high-quality and scalable solutions aligned with operational and strategic objectives
• Proactive and accountable, with the ability to challenge requirements, drive improvements, and take ownership of outcomes
• Shows strong technical curiosity and continuous learning mindset

Skills

• Strong technical expertise in cybersecurity, with the ability to design, implement, and evolve automation and detection capabilities within a CyberDefense environment
• Proven experience in cybersecurity automation and orchestration, including the development of scalable workflows and integrations
• Solid understanding of security monitoring and detection ecosystems, including SIEM, EDR/XDR, Threat Intelligence platforms, and case management solutions
• Strong knowledge of detection engineering practices, including rule design, tuning, and lifecycle management within a Detection-as-Code approach
• Experience with scripting and development (e.g., Python, APIs), enabling automation, integration, and industrialization of cybersecurity processes
• Good understanding of incident response processes and operational constraints, ensuring alignment between detection, investigation, and automated response
• Ability to translate operational needs into technical solutions.
• Strong analytical and problem-solving capabilities, with a rigorous and structured approach to complex technical challenges
• Excellent communication and collaboration skills, with the ability to engage both technical and non-technical stakeholders
• Fluent in English, with the ability to operate effectively in an international context

Why Join Us?

Motivational Environment
Join a dynamic team of passionate professionals, actively involved in prestigious cybersecurity collaboration networks. Be part of a culture that values excellence, innovation, and mutual support.

Challenging Topics
Contribute to multiple high-impact projects that tackle real-world cybersecurity challenges. Your expertise will make a difference.

Empowered Voices
Your ideas matter. As a valued team member, your input will be heard, respected, and considered in decision-making processes.

Technical Growth
Advance your skills through tailored training programs and hands-on experience. We invest in your development to help you reach your full potential.