Cybersecurity Remediation Expert

November 8, 2026

Office

Senior

Paris, France

Indeed

Keep in mind

Original vacancy is in French
You will likely need French for the job. The employer can confirm
Office-only work

Also worth knowing

English is required

Description

A cybersecurity audit firm is recruiting a Cybersecurity Remediation Expert to join its CSIRT remediation and incident response division. The role covers post-incident containment, system reconstruction and hardening, converting security audit findings into prioritized remediation plans, and formalizing CSIRT methodologies. The consultant also writes deliverables, monitors threats and contributes to pre-sales. The firm's incident response activity is qualified as PRIS by the national cybersecurity agency.

Responsibilities

Define and implement containment measures (isolation, access blocking, secret rotation) then threat eradication (removing persistence mechanisms, illegitimate accounts and accesses), in coordination with forensic analysts
Design and lead the reconstruction of critical SI components (Active Directory, messaging, virtualization, backups) and support the controlled restart of business services
Clean up directories and identity environments (Active Directory, Entra ID), reset privileged accounts and sensitive secrets (krbtgt, service accounts), review delegations and rights
Propose and deploy immediate hardening measures to limit re-compromise risk (tier administration model, segmentation, filtering, EDR, logging)
Formalize the short, medium and long-term remediation plan and contribute to post-incident reviews
Exploit audit deliverables (penetration tests, Red Team, Active Directory, architecture, configuration or code audits) to qualify and prioritize vulnerabilities by risk and client context
Build prioritized, realistic and costed action plans in coordination with the client's IT and security teams
Support or directly perform technical corrections (configurations, patches, Active Directory and system hardening, access rights management, network segmentation)
Verify the effectiveness of corrections (re-audit, security non-regression tests) and track progress until findings are closed
Work closely with auditors to propose a coherent end-to-end audit plus remediation offer
Formalize and evolve CSIRT remediation methodologies, procedures, scripts and deliverable templates in line with the ANSSI PRIS framework
Write quality deliverables (remediation plans, hardening guides, intervention reports) suited to both technical contacts and management
Contribute to pre-sales phases (technical scoping, effort estimation, writing technical proposals) and detect cross-sell opportunities (audit, data recovery, crisis management)
Run continuous monitoring of threats, attack techniques and hardening best practices (ANSSI guides, CIS Benchmarks, vendor recommendations)
Track ANSSI work on integrating remediation into the PRIS framework and help prepare the CSIRT for qualification, undergoing the individual evaluation required for the remediation scope if applicable

Requirements

3 to 5 years of experience in operational security, secure systems and network engineering or remediation, within a CSIRT, cybersecurity consulting firm or IT department
Mastery of Microsoft environments: Active Directory (tier administration model, GPO, delegations, PKI), Entra ID and Microsoft 365
Good knowledge of Linux environments, virtualization technologies (VMware, Hyper-V), backup solutions and network infrastructure (firewall, segmentation, VPN)
Good understanding of attack techniques (MITRE ATT&CK: persistence, lateral movement, privilege escalation) and ability to exploit penetration test reports
Advanced knowledge of security solutions (EDR, SIEM, bastion, PAM) and hardening frameworks (ANSSI guides, CIS Benchmarks)
Scripting skills (PowerShell, Python, Bash) to automate remediation operations
Fluent English
Incident response experience is a plus
Ideally hold technical certifications (e.g. OSCP, GIAC, Microsoft certifications)
Ability to act effectively in emergency or crisis situations and to propose pragmatic solutions within the client's operational and budget constraints
Ability to explain technical challenges and get teams to support remediation plans
Rigor in tracking actions and the quality of deliverables

Conditions

Permanent contract at offices in Paris, Lyon or Toulouse
Regular on-site interventions at client sites in metropolitan France and occasionally in the European Union
Occasional travel within the group's entities

Similar jobs

Similar in meaning, not just matching keywords

This device does not meet the site requirements

What may not work

Cybersecurity Remediation Expert

Job summary

Keep in mind

Also worth knowing

Description

Responsibilities

Requirements

Conditions

Similar jobs

Job summary

Similar jobs

More on this topic

Cybersecurity Remediation Expert

Job summaryAnalysis and summary of the descriptionSo-so [data-chart=chart-_R_39f1a6av5ubsmabqqqlb_] { --color-score: var(--warning); } .dark [data-chart=chart-_R_39f1a6av5ubsmabqqqlb_] { --color-score: var(--warning); } 67

Job summary

Keep in mind

Also worth knowing

Description

Responsibilities

Requirements

Conditions

Similar jobs

Job summaryAnalysis and summary of the descriptionSo-so [data-chart=chart-_R_39f1a6av5ubsmabqqqlb_] { --color-score: var(--warning); } .dark [data-chart=chart-_R_39f1a6av5ubsmabqqqlb_] { --color-score: var(--warning); } 67

Job summary

Similar jobs

More on this topic