Team Lead, SOC

SOC (Security Operations Center), Team Lead Join to apply for the SOC (Security Operations Center) Team Lead role at Mistral AI. About Mistral At Mistral AI, we believe in the power of AI to simplify tasks, save time, and enhance learning and creativity. Our technology is designed to integrate seamlessly into daily working life. We democratize AI through high-performance, optimized, open-source and cutting‑edge models, products and solutions. Our comprehensive AI platform is designed to meet enterprise needs, whether on‑premises or in cloud environments. Our offerings include le Chat, the AI assistant for life and work. We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between France, USA, UK, Germany and Singapore. We are creative, low‑ego and team‑spirited. Join us to be part of a pioneering company shaping the future of AI. Together, we can make a meaningful impact. See more about our culture on https://mistral.ai/careers. Role Summary We are looking for a SOC (Security Operations Center) Team Lead to build and lead our SOC function end‑to‑end. You will own vulnerability management, alerting and detection engineering, incident response, and the security tooling/infrastructure that enable these missions. You’ll define processes, collaborate closely with Product, Infra and IT, and continuously improve detection quality and response time. Key Missions & Objectives Establish a best-in-class SOC. Reduce MTTA/MTTR. Drive vulnerability remediation. Raise detection coverage and precision. Ensure robust incident handling and communication. Reporting line: Reports to the Head of Security. Location: Paris (on‑site hybrid). What You Will Do Lead & grow the team: Manage the SOC team, shape the roadmap, delegate effectively, and mentor engineers. Drive operations: Define vulnerability management processes and coordinate stakeholders for timely remediation. Design, implement, and operate SIEM/SOAR infrastructure (ingestion, normalization, correlation, alerting, playbooks). Specify logging requirements across our main stacks and centralize telemetry in the SIEM. Develop and tune correlation rules and detections; manage CTI intake and operationalize intel. Run continuous improvement to reduce false positives and raise signal quality. Establish crisp procedures for alert triage, escalation, and incident handling & investigation. Lead incident communications with stakeholders and ensure thorough documentation. Engineering & enablement: Contribute to security tooling, automation, and integrations that speed up detection/response. Produce guidance and documentation for product/infra teams; contribute to compliance in the SOC perimeter. Exercises & assurance: Coordinate red/blue exercises, post‑mortems, and targeted audits to validate coverage and resilience. Who You Are 5+ years of experience leading SOC/CSIRT functions, with proven incident leadership. Hands‑on with SIEM (e.g., Elastic Security, Sekoia, Splunk) and SOAR platforms. Strong experience in vulnerability management (e.g., DefectDojo, Dependency‑Track) and remediation workflows. Solid grasp of the cyber kill chain / attack lifecycle, detection engineering, and log source coverage. Excellent problem‑solving and communication skills; able to operate in a fast‑paced startup environment. Builder mindset: pragmatic, automation‑oriented, comfortable with ambiguity and ownership. Nice to Have Bring scripting/automation skills (e.g., Python, Bash) for data pipelines/playbooks. Know modern infra/app stacks (Linux, containers, Kubernetes, cloud), EDR/IDS/IPS. Have exposure to compliance frameworks (ISO 27001, SOC 2) and security audits/pen‑tests. Have run purple team exercises and measurable detection‑coverage programs. Are comfortable partnering with Product/Platform teams and influencing roadmaps. Recruitment Process Introduction call (30 min) Technical Screen (30 min) Technical Round (45 min) Hiring Manager (30 min) Value talk / Culture fit (30 min) References Location & Remote This role is primarily based at one of our European offices (Paris, France and London, UK). We will prioritize candidates who either reside there or are open to relocating. We strongly believe in the value of in‑person collaboration to foster strong relationships and seamless communication within our team. In certain specific situations, we will also consider remote candidates based in France and UK. In that case, new hires are expected to visit their local office for the first week of onboarding (accommodation and travelling covered) and then at least three days per month. What We Offer Competitive salary and equity Health insurance Transportation allowance Sport allowance Meal vouchers Private pension plan Generous parental leave policy Visa sponsorship We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. Final hiring decisions are ultimately made by humans. Referrals increase your chances of interviewing at Mistral AI by 2x. #J-18808-Ljbffr