Senior Security Operations Engineer

ABOUT CFM Founded in 1991, we are a global quantitative and systematic asset management firm applying a scientific approach to finance to develop alternative investment strategies that create value for our clients. We value innovation, dedication, collaboration, and the ability to make an impact. Together, we create a stimulating environment for talented and passionate experts in research, technology, and business to explore new ideas and challenge existing assumptions. Your Role Join our Security team as a Senior Security Operations Engineer (SOC L3) and help strengthen our security posture across a hybrid environment (on‑prem and AWS). Directly reporting to our Security Operations Lead, you will participate in CSIRT/CERT operations, lead advanced incident investigations, conduct threat hunting and forensic analysis, and continuously improve our detection and response capabilities. You will also operate and evolve our security tooling (e.g., SIEM, SOAR, EDR, WAF, vulnerability management) and partner with technical teams to embed security by design through reviews and threat modeling. You will partner closely with our IT teams to drive remediation and reliability. Key Responsibilities Security operations platform ownership - Operate, maintain, and continuously improve security platforms (SIEM/SOAR, endpoint security, vulnerability management, web protection, email/security controls, secrets management, etc.). - Ensure platform availability, performance, and resilience through upgrades/patching, configuration reviews, access controls, health checks, and periodic validation/testing. - Improve telemetry quality: logging coverage, data onboarding/normalization, retention requirements, and integration of reliability. Incident Response & forensics - Lead end-to-end incident responses for complex security events. - Perform forensic investigations across endpoints, servers, and cloud workloads (AWS): acquire and preserve evidence, analyze artifacts, and reconstruct attack timelines. - Produce high-quality incident deliverables: executive summary, technical report, impact analysis, root cause, IOCs, and lessons learned with prioritized actions. - Coordinate with IT/Engineering to execute remediation actions (account resets, host isolation, key rotation, patching) and validate post-incident security. - Support incident communications and stakeholder management, including escalation, regulatory/compliance inputs when needed, and post-incident reviews. Security-by-design & technical assurance - Serve as the security technical point of contact for projects and changes (on‑prem and AWS): define/validate security requirements and provide pragmatic architecture guidance. - Conduct technical security reviews and threat modeling for applications, infrastructure, and cloud changes. - Perform risk assessments for requests (e.g., new applications, integrations, browser extensions) and recommend controls. External security activities - Coordinate external security partners (penetration tests, vulnerability assessments, purple-team exercises): scope, rules of engagement, access Your Skills Must-Have - Bachelor's degree in computer science, Information Security (or related) or equivalent professional experience. - 5+ years in security operations / security engineering / incident response roles. - Hands-on experience operating and improving a modern security stack (e.g., SIEM, SOAR, EDR, WAF, vulnerability management). - Strong AWS security foundations (IAM, networking/VPC concepts, native controls, logging/monitoring strategy). - Solid application security knowledge (AuthN/AuthZ, OWASP Top 10, API security, CSP concepts). - Proven incident response experience: investigation, containment, eradication, RCA (forensic experience valued). - Strong networking fundamentals (TCP/IP, HTTP/S, DNS, SMTP, SSH, TLS, firewalling) and ability to analyze logs/traffic. - Ability to develop and maintain automation/scripts (Python required). - Fluency in French and English. Nice-to-Have - Security certifications (e.g., CISSP, GCIA/GCIH, SIEM-related) or equivalent experience. - Experience in regulated industries (healthcare/fintech/govtech). - Comfortable working cross-functionally with Security, IT, Engineering, and Compliance. - Familiarity with engineering workflows (Git-based collaboration, CI/CD concepts). Note - Remote work is permitted for up to two days per week. - This position involves taking part in on-call responsibilities. EQUAL OPPORTUNITIES STATEMENT We are continuously striving to be an equal opportunity employer and we prohibit any discrimination based on sex, disability, origin, sexual orientation, gender identity, age, race, or religion. We believe that our diversity, breadth of experience, and multiple points of view are among the leading factors in our success. CFM is a signatory of the Women Empowerment Principles . FOLLOW US Follow us on Twitter or LinkedIn or visit our website to find out more about CFM.