CyberSecurity Engineer, Incident Response Lead

Role Summary

Mistral AI is looking for a senior Incident Response and Digital Forensics specialist to lead our incident response capability across a complex, rapidly evolving AI ecosystem.

Reporting to the SOC Lead, you will take end‑to‑end ownership of major security incidents, from initial investigation and containment through remediation and post‑incident improvement.

Responsibilities

• Own the incident response lifecycle for high‑severity security events, including triage, investigation, containment, remediation, recovery, and post‑incident review.
• Act as incident commander, coordinating technical teams and key stakeholders during complex security incidents.
• Build, maintain, and test incident response runbooks covering Mistral’s most important risk scenarios.
• Develop and operate forensic capabilities across cloud, containerized, on‑premises, and endpoint environments.
• Preserve, collect, and analyze digital evidence using rigorous and repeatable forensic methodologies.
• Partner with SOC and Detection Engineering teams to strengthen detection‑to‑response workflows and improve investigative readiness.
• Design and facilitate tabletop exercises with engineering, legal, communications, and leadership stakeholders.
• Lead blameless post‑mortems and ensure lessons learned translate into durable technical and organizational improvements.
• Define clear incident communication and escalation practices for both technical and non‑technical stakeholders.
• Contribute to the long‑term development of Mistral’s incident response function, with the potential to mentor or lead future team members.

Qualifications

• Significant experience leading complex incident response and digital forensics investigations in cloud‑native, technology, or similarly high‑stakes environments.
• Demonstrated ability to take command during critical incidents and coordinate multidisciplinary teams under pressure.
• Strong knowledge of cloud and container forensics, including environments such as AWS, GCP, Kubernetes, and on‑premises infrastructure.
• Hands‑on experience with endpoint forensics, ideally including mac OS environments.
• Strong understanding of attacker behaviors, investigation methodologies, evidence handling, and the MITRE ATT&CK framework.
• Experience building incident response runbooks, forensic workflows, tabletop exercises, and post‑incident review practices.
• Ability to automate investigative or response workflows using Python, Go, or similar languages.
• Excellent written and verbal communication skills, with the ability to communicate clearly with engineers, legal teams, executives, and other stakeholders.
• A calm, methodical, and pragmatic approach, combined with a strong sense of ownership.
• Experience mentoring others or helping build an incident response capability is highly valued.
• Location & Working Model
• Location: Paris, France Working model: Hybrid Scope: Global Level: Senior / Staff
• #J-18808-Ljbffr