IT Security Operations Engineer (IT)

We’re a team of experts pushing the limits of what’s possible, united by our common goal to unlock true freedom through digital ownership, making technology accessible for all. We believe change is constant and our team moves forward as one, with a culture of problem-solving where every employee is empowered and supported to challenge tradition and create solutions. At Ledger, we’re proud to be the global platform for digital assets and Web3, with over 20% of the world’s crypto assets secured through our Ledger devices. With our headquarters in Paris, and offices in Vierzon, Grenoble, Montpellier, London, Portland, Geneva, Zurich and Central Singapore, we have a team of around 600 professionals developing a variety of products and services to enable individuals and companies to securely buy, store, swap, grow and manage crypto assets - including the Ledger hardware wallets line with more than 7.5 millions units already sold in 200 countries. You’ll join the Security Operations team, responsible for protecting Ledger’s corporate, cloud, SaaS, and data center environments. Its mission: to anticipate, detect, investigate, and respond to cyber threats—including monitoring, alert triage, incident response, detection, visibility, automation, exposure tracking, and continuous process improvement. As a close-knit and experienced team—technically demanding and committed to knowledge sharing—we’re also continuously building the SOC itself: integrating new log sources, ensuring data quality, expanding detection coverage, and developing reliable dashboards and operational workflows. Wiz for cloud security and exposure management; - AWS, including modern environments such as EKS/Kubernetes; - An in-house developed Agentic SOC for alert enrichment, correlation, investigation support, reporting, and automation. We’ve built our own in-house Agentic SOC, which autonomously investigates weak signals—the large volume of unreliable alerts that a human team couldn’t sort through manually—and enriches them, so our engineers can focus on what matters most and resolve incidents faster: high-quality detection, noise reduction, and accelerated investigations. As a Staff Security Operations Engineer, you are the SecOps team’s top technical expert and our go-to authority on incident management. Above all, you’re a builder: beyond design, you’ll build and actively evolve our systems—the Agentic SOC, the log pipeline, and automation—with a solid understanding of the underlying infrastructure. Critical Incident Response (CSIRT) - Serve as the primary point of contact and coordinator for the most complex incidents across the cloud, corporate systems, endpoints, identities, and the data center. - Bring our Splunk environment up to standard and state-of-the-art: data quality and standardization (CIM), data models, search performance, and detection governance. - Build, evolve, and own the architecture of our internal Agentic SOC and our log/data pipeline, and lead the automation of reporting for the SecOps team. - Mentor and foster the technical growth of senior and junior engineers, and act as a force multiplier within SecOps. - Work with the Engineering, Infrastructure, IT, and Cloud teams to align operational security with the organization’s objectives.