SOC (Security Operations Center), Team Lead

About Mistral 

At Mistral AI, we believe in the power of AI to simplify tasks, save time, and enhance learning and creativity. Our technology is designed to integrate seamlessly into daily working life.

We democratize AI through high-performance, optimized, open-source and cutting-edge models, products and solutions. Our comprehensive AI platform is designed to meet enterprise needs, whether on-premises or in cloud environments. Our offerings include le Chat, the AI assistant for life and work.

We are a dynamic, collaborative team passionate about AI and its potential to transform society.

Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between France, USA, UK, Germany and Singapore. We are creative, low-ego and team-spirited.

Join us to be part of a pioneering company shaping the future of AI. Together, we can make a meaningful impact. See more about our culture on 

Role summary

We are looking for a SOC (Security Operations Center) Team Lead to build and lead our SOC function end-to-end. You will own vulnerability management, alerting and detection engineering, incident response, and the security tooling/infrastructure that enable these missions. You'll define processes, collaborate closely with Product, Infra and IT, and continuously improve detection quality and response time.

Key missions & objectives: Establish a best-in-class SOC; reduce MTTA/MTTR; drive vulnerability remediation; raise detection coverage and precision; ensure robust incident handling and communication.

Reporting line: Reports to the Head of Security.

Location: Paris (on-site hybrid).

What you will do

• Lead & grow the team: Manage the SOC team, shape the roadmap, delegate effectively, and mentor engineers.

• Drive operations:

– Define vulnerability management processes and coordinate stakeholders for timely remediation.

– Design, implement, and operate SIEM/SOAR infrastructure (ingestion, normalization, correlation, alerting, playbooks).

– Specify logging requirements across our main stacks and centralize telemetry in the SIEM.

– Develop and tune correlation rules and detections; manage CTI intake and operationalize intel.

– Run continuous improvement to reduce false positives and raise signal quality.

– Establish crisp procedures for alert triage, escalation, and incident handling & investigation.

– Lead incident communications with stakeholders and ensure thorough documentation.

• Engineering & enablement:

– Contribute to security tooling, automation, and integrations that speed up detection/response.

– Produce guidance and documentation for product/infra teams; contribute to compliance in the SOC perimeter.

• Exercises & assurance: Coordinate red/blue exercises, post-mortems, and targeted audits to validate coverage and resilience.

Who you are

• 5+ years of experience leading SOC/CSIRT functions, with proven incident leadership.

• Hands-on with SIEM (e.g., Elastic Security, Sekoia, Splunk) and SOAR platforms.

• Strong experience in vulnerability management (e.g., DefectDojo, Dependency-Track) and remediation workflows.

• Solid grasp of the cyber kill chain / attack lifecycle, detection engineering, and log source coverage.

• Excellent problem-solving and communication skills; able to operate in a fast-paced startup environment.

• Builder mindset: pragmatic, automation-oriented, comfortable with ambiguity and ownership.

Now, it would be ideal if you… (Nice to have)

• Bring scripting/automation skills (e.g., Python, Bash) for data pipelines/playbooks.

• Know modern infra/app stacks (Linux, containers, Kubernetes, cloud), EDR/IDS/IPS.

• Have exposure to compliance frameworks (ISO 27001, SOC 2) and security audits/pen-tests.

• Have run purple team exercises and measurable detection-coverage programs.

• Are comfortable partnering with Product/Platform teams and influencing roadmaps.

Recruitment process

• Introduction call (30 min)

• Technical Rounds:

- Technical Screen (30 min)

- Technical Round (45 min)

• Hiring Manager (30 min)

• Value talk / Culture fit (30 min)

• References

Location & Remote

This role is primarily based at one of our European offices (Paris and London). We will prioritize candidates who either reside there or are open to relocating. We strongly believe in the value of in-person collaboration to foster strong relationships and seamless communication within our team. Our remote work policy is designed to offer flexibility, enhance work-life balance, and boost productivity.

In certain specific situations, we will also consider remote candidates based in one of the countries listed in this job posting (currently France & UK). In that case, we ask all new hires to visit our local office:

•  for the first week of their onboarding (accommodation and travelling covered)

•  then at least 3 days per month

What we offer

Competitive salary and equity

Health insurance

Transportation allowance

Sport allowance

Meal vouchers

Private pension plan

Parental : Generous parental leave policy

Visa sponsorship