CyberSecurity Engineer, Incident Response Lead

Das ist der Job

Build, maintain, and test incident response runbooks covering Mistral’s most important risk scenarios.

Darum lohnt es sich

Act as incident commander, coordinating technical teams and key stakeholders during complex security incidents. Partner with SOC and Detection Engineering teams to strengthen detection‑to‑response workflows and improve investigative readiness.

Contribute to the long‑term development of Mistral’s incident response function, with the potential to mentor or lead future team members. Demonstrated ability to take command during critical incidents and coordinate multidisciplinary teams under pressure.

Excellent written and verbal communication skills, with the ability to communicate clearly with engineers, legal teams, executives, and other stakeholders. Role Summary Mistral AI is looking for a senior Incident Response and Digital Forensics specialist to lead our incident response capability across a complex, rapidly evolving AI ecosystem.

Reporting to the SOC Lead, you will take end‑to‑end ownership of major security incidents, from initial investigation and containment through remediation and post‑incident improvement.

Responsibilities Own the incident response lifecycle for high‑severity security events, including triage, investigation, containment, remediation, recovery, and post‑incident review. Develop and operate forensic capabilities across cloud, containerized, on‑premises, and endpoint environments.

Preserve, collect, and analyze digital evidence using rigorous and repeatable forensic methodologies. Design and facilitate tabletop exercises with engineering, legal, communications, and leadership stakeholders. Lead blameless post‑mortems and ensure lessons learned translate into durable technical and organizational improvements.

Define clear incident communication and escalation practices for both technical and non‑technical stakeholders. Qualifications Significant experience leading complex incident response and digital forensics investigations in cloud‑native, technology, or similarly high‑stakes environments.

Strong knowledge of cloud and container forensics, including environments such as AWS, GCP, Kubernetes, and on‑premises infrastructure. Hands‑on experience with endpoint forensics, ideally including macOS environments. Strong understanding of attacker behaviors, investigation methodologies, evidence handling, and the MITRE ATT&CK framework.

Experience building incident response runbooks, forensic workflows, tabletop exercises, and post‑incident review practices. Ability to automate investigative or response workflows using Python, Go, or similar languages. A calm, methodical, and pragmatic approach, combined with a strong sense of ownership.

Experience mentoring others or helping build an incident response capability is highly valued. Location & Working Model Location: Paris, France Working model: Hybrid Scope: Global Level: Senior / Staff #J-18808-Ljbffr