<div><b>About Mistral </b></div><div><br /></div><div><span>At Mistral AI, we believe in the power of AI to simplify tasks, save time, and enhance learning and creativity. Our technology is designed to integrate seamlessly into daily working life. </span></div><div><br /></div><div><span>We democratize AI through high-performance, optimized, open-source and cutting-edge models, products and solutions. Our comprehensive AI platform is designed to meet enterprise needs, whether on-premises or in cloud environments. Our offerings include le Chat, the AI assistant for life and work.</span></div><div><br /></div><div><span>We are a dynamic, collaborative team passionate about AI and its potential to transform society.</span></div><div><span>Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between France, USA, UK, Germany and Singapore. We are creative, low-ego and team-spirited.</span></div><div><br /></div><div><span>Join us to be part of a pioneering company shaping the future of AI. Together, we can make a meaningful impact. See more about our culture on </span><a href="https://mistral.ai/careers">https://mistral.ai/careers</a><span>.</span></div><div><br /></div><div><b>Role summary</b></div><div><span>We are looking for a </span><b>SOC (Security Operations Center) Team Lead</b><span> to build and lead our SOC function end-to-end. You will own vulnerability management, alerting and detection engineering, incident response, and the security tooling/infrastructure that enable these missions. You’ll define processes, collaborate closely with Product, Infra and IT, and continuously improve detection quality and response time.</span></div><div><br /></div><div><b>Key missions &amp; objectives:</b><span> Establish a best-in-class SOC; reduce MTTA/MTTR; drive vulnerability remediation; raise detection coverage and precision; ensure robust incident handling and communication.</span></div><div><br /></div><div><b>Reporting line:</b><span> Reports to the Head of Security.</span></div><div><b>Location:</b><span> Paris (on-site hybrid).</span></div><div><br /></div><div><b>What you will do</b></div><div><span> • </span><b>Lead &amp; grow the team:</b><span> Manage the SOC team, shape the roadmap, delegate effectively, and mentor engineers.</span></div><div><span> • </span><b>Drive operations:</b></div><div><span> – Define vulnerability management processes and coordinate stakeholders for timely remediation.</span></div><div><span> – Design, implement, and operate SIEM/SOAR infrastructure (ingestion, normalization, correlation, alerting, playbooks).</span></div><div><span> – Specify logging requirements across our main stacks and centralize telemetry in the SIEM.</span></div><div><span> – Develop and tune correlation rules and detections; manage CTI intake and operationalize intel.</span></div><div><span> – Run continuous improvement to reduce false positives and raise signal quality.</span></div><div><span> – Establish crisp procedures for alert triage, escalation, and incident handling &amp; investigation.</span></div><div><span> – Lead incident communications with stakeholders and ensure thorough documentation.</span></div><div><span> • </span><b>Engineering &amp; enablement:</b></div><div><span> – Contribute to security tooling, automation, and integrations that speed up detection/response.</span></div><div><span> – Produce guidance and documentation for product/infra teams; contribute to compliance in the SOC perimeter.</span></div><div><span> • </span><b>Exercises &amp; assurance:</b><span> Coordinate red/blue exercises, post-mortems, and targeted audits to validate coverage and resilience.</span></div><div><br /></div><div><br /></div><div><b>Who you are</b></div><div><span> • 5+ years of experience </span><b>leading SOC/CSIRT</b><span> functions, with proven incident leadership.</span></div><div><span> • Hands-on with </span><b>SIEM</b><span> (e.g., Elastic Security, Sekoia, Splunk) and </span><b>SOAR</b><span> platforms.</span></div><div><span> • Strong experience in </span><b>vulnerability management</b><span> (e.g., DefectDojo, Dependency-Track) and remediation workflows.</span></div><div><span> • Solid grasp of the </span><b>cyber kill chain / attack lifecycle</b><span>, detection engineering, and log source coverage.</span></div><div><span> • Excellent problem-solving and communication skills; able to operate in a fast-paced startup environment.</span></div><div><span> • Builder mindset: pragmatic, automation-oriented, comfortable with ambiguity and ownership.</span></div><div><br /></div><div><span>Now, it would be ideal if you… </span><i>(Nice to have)</i></div><div><span> • Bring scripting/automation skills (e.g., Python, Bash) for data pipelines/playbooks.</span></div><div><span> • Know modern infra/app stacks (Linux, containers, Kubernetes, cloud), EDR/IDS/IPS.</span></div><div><span> • Have exposure to compliance frameworks (ISO 27001, SOC 2) and security audits/pen-tests.</span></div><div><span> • Have run </span><b>purple team</b><span> exercises and measurable detection-coverage programs.</span></div><div><span> • Are comfortable partnering with Product/Platform teams and influencing roadmaps.</span></div><div><br /></div><div><b>Recruitment process</b></div><div><span> • Introduction call (30 min)</span></div><div><span> • Technical Rounds:</span></div><div><span>- Technical Screen (30 min)</span></div><div><span>- Technical Round (45 min) </span></div><div><span> • Hiring Manager (30 min)</span></div><div><span> • Value talk / Culture fit (30 min)</span></div><div><span> • References</span></div><div><span>Location &amp; Remote</span></div><div><br /></div><div>The position is based in our Paris HQ offices and we encourage going to the office as much as we can (at least 3 days per week) to create bonds and smooth communication. Our remote policy aims to provide flexibility, improve work-life balance and increase productivity. Each manager can decide the amount of days worked remotely based on autonomy and a specific context (e.g. more flexibility can occur during summer). In any case, employees are expected to maintain regular communication with their teams and be available during core working hours.</div><div><br /></div><div><span>What we offer</span></div><div><br /></div><div>💰 Competitive salary and equity package</div><div>🧑‍⚕️ Health insurance</div><div>🚴 Transportation allowance</div><div>🥎 Sport allowance</div><div>🥕 Meal vouchers</div><div>💰 Private pension plan</div><div>🍼 Generous parental leave policy</div>