Soc engineer h/f

Europcar Mobility Group

Europcar Mobility Group est un acteur mondial de la mobilité, avec 75 ans d'expertise des services de mobilité et une position de leader en Europe. We help to change the way you move est notre raison d'être et ce qui nous rassemble.

Plus que jamais, nous nous engageons à fournir des solutions simples, transparentes et innovantes qui rendent la mobilité simple, plus agréable et de plus en plus respectueuse de l'environnement. Pour ce faire, nous proposons aux particuliers et aux entreprises une large gamme de services de location de voitures et d'utilitaires, que ce soit pour quelques heures, quelques jours, une semaine, un mois ou plus, à la demande ou sur abonnement, grâce à une flotte de plus de 250 000 véhicules, dotée des motorisations les plus récentes et une part croissante de véhicules électriques.

Nos marques répondent à des besoins, des cas d'utilisation et des attentes différenciés : Europcar® - un des leaders mondiaux de la location de voitures et de véhicules utilitaires, Goldcar® - leader de la location de voitures « low cost » en Europe, FoxRent-A-Car®, l'un des principaux acteurs du marché de la location de voitures aux États-Unis, avec un positionnement "value for money", et Ubeeqo® - l'un des leaders européens du car sharing (BtoB, BtoC). La satisfaction client est au coeur de l'ambition du Groupe et de celle de ses plus de 8000 collaborateurs partout où il opère, à travers un vaste réseau dans plus de 130 pays (comprenant 16 filiales, complétées par des franchisés et des partenaires). MISSION:
Ensure EMG's digital assets, cloud platforms, applications, infrastructure, APIs, and data ecosystems are continuously monitored, protected, and defended against cyber threats.

The SOC Engineer is responsible for:

* Building and tuning security detections
* Operating EMG's SIEM/SOAR platforms (Splunk, cloud-native tools)
* Handling cyber investigations and forensics activities
* Enhancing visibility across cloud, on-prem, and application layers
* Supporting threat hunting, response, and vulnerability remediation
* Ensuring alignment with EMG security policies, CISO directives, and regulatory obligations

This role is essential for maintaining EMG's cybersecurity resilience in a hybrid and modernized technology landscape.

MISSION:
Ensure EMG's digital assets, cloud platforms, applications, infrastructure, APIs, and data ecosystems are continuously monitored, protected, and defended against cyber threats.

The SOC Engineer is responsible for:

* Building and tuning security detections
* Operating EMG's SIEM/SOAR platforms (Splunk, cloud-native tools)
* Handling cyber investigations and forensics activities
* Enhancing visibility across cloud, on-prem, and application layers
* Supporting threat hunting, response, and vulnerability remediation
* Ensuring alignment with EMG security policies, CISO directives, and regulatory obligations

This role is essential for maintaining EMG's cybersecurity resilience in a hybrid and modernized technology landscape.

MAIN RESPONSABILITIES:



1. Security Monitoring & Detection Engineering
Develop and maintain detection rules, dashboards, alerts, correlation logic, and analytics within:

* Splunk (SIEM)
* SOAR (such as n8n)
* cloud-native SIEM/SOC tools
* endpoint detection tools (EDR/XDR)
* identity logs

Build detections and emerging threat patterns.
Configure, monitor and troubleshoot security infrastructure devices and services such as EDR, DLP or CASB
Identify opportunities for, and promote automation and new technical solutions and security tools to help mitigate security vulnerabilities and improve efficiency

2. Incident Investigation & Threat Response
Perform L3 investigation of security alerts, including:

* anomalous authentication events
* suspicious network activities
* endpoint compromises
* cloud misconfigurations
* API misuse or credential abuse

Execute containment and remediation actions in collaboration with cybersecurity teams, IT Ops and Engineering teams
Produce clear incident reports and contribute to RCA and continuous improvement.
Establishing disaster recovery procedures and conducting breach of security drills.

3. Threat Hunting
Conduct proactive threat hunts using:

* log patterns
* anomalous behavior detection
* threat intel feeds
* historical investigations
* cloud & API-specific threat vectors

Identify gaps in security visibility and propose instrumentation improvements.

4. Security Logging & Observability Integration
Ensure complete and reliable logging coverage across:

* Cybersecurity tools (EDR, DLP, etc.)
* APIs
* cloud workloads
* network traffic
* databases
* CI/CD systems (GitLab)

Work with Observability teams to ensure correlated visibility (Dynatrace + Splunk).

5. Vulnerability & Attack Surface Support
Support vulnerability management by correlating findings with real activity logs.

Validate remediation and track exploitation attempts related to EMG systems.
Assist IT Ops and Engineering teams to prioritize and mitigate vulnerabilities.

6. Cyber Security Controls Validation
Validate enforcement of cybersecurity standards (E.g., Zero Trust, MFA, encryption, identity governance).
Test security controls effectiveness through simulations or red-team collaboration.

7. Documentation, Playbooks & Knowledge Sharing
Maintain SOC runbooks, response playbooks, detection documentation, and forensic procedures.
Identify and communicate current and emerging security threats

8. Collaboration Across IT & Business
Work closely with:

* CISO (governance, escalation, risk alignment)
* Cybersecurity Architecture Manager
* IAM teams
* Cloud & Production Services
* Network & Infrastructure Ops
* Domain Engineering Teams
* Ensure consistent communication and coordination during incidents and monitoring activities.