Cyber Defense Engineer
ESTREEM
Required skills
About the role
Translated into English from French by Korum. The employer's original wording is on their site.
Estreem : the new benchmark for payment processing in Europe
Born out of a strategic partnership between two major French banking groups, BNP Paribas and BPCE, Estreem is an independent fintech launched in February 2025. Its ambition: to become the first sovereign payment processor in France, capable of operating at European scale.
In a payments sector undergoing full transformation, Estreem positions itself as a disruptive player, combining security, technological agility and economic competitiveness. The goal is clear: to rapidly join the TOP 3 European processors.
Built on a next-generation platform, Estreem covers the entire card processing value chain, from software publishing to operational management, relying on state-of-the-art infrastructure (cloud). It supports all major payment schemes (CB, Visa, Mastercard) as well as new European schemes, such as Wero.
Designed from the outset to reach beyond French borders, Estreem aims to become a pillar of European strategic autonomy in the payments field.
The 3“E” of Estreem sum up its DNA: Excellence in technology, Expertise in the business, and a strong European vision.
📍Where we are: Paris, Lyon, Toulouse
More information about Estreem and our projects is available on our website : Estreem | European Payment Processing for Banks
💼 Your role at Estreem
Reporting to the SOC Manager, the Cyber Defense Engineer contributes to the operational security of the Estreem platform, in line with the requirements in force (PCI DSS, NIST, IBM FS Cloud, ISO 27001…). The SOC is being built: they actively take part in setting up detection capabilities, qualifying alerts and responding to incidents, working closely with the IT, Cloud and SRE teams and the business teams.
Your responsibilities:Monitoring & detectionMonitor the security events raised by the tools in place (SIEM, EDR, etc.).
Analyse, qualify and prioritise alerts according to their criticality.
Contribute to defining and improving detection rules and use cases, in liaison with the SOC Manager.
Carry out second-level handling of security incidents.
Continuously improve first-level incident management and automate it using the features offered by the SOAR.
Document analyses and contribute to writing incident reports.
Escalate to the SOC Manager any incidents beyond your scope or requiring a decision.
Contribute to regular threat hunting activities.
Monitor threat intelligence sources relevant to the payments sector.
Identify threats, TTPs and attack vectors relevant to the Estreem environment.
Take part in integrating new log sources into SOC tools (SIEM/SOAR).
Contribute to the day-to-day operation and tuning of security tools (SIEM, EDR, SOAR).
Contribute to writing and updating SOC procedures and playbooks.
Take part in internal and external security audits.
Context and technical environment
The Cyber Defense Engineer works in a dual environment, typical of the banking and card payments sector:
A classic corporate IT environment (workstations, messaging and collaboration tools in SaaS mode, Windows and Linux infrastructure).
A critical payment platform, hosted in hybrid cloud mode, built on a containerised and orchestrated microservices architecture, exposed via internal and external APIs.
The Cyber Defense Engineer is required to supervise and analyse security events from varied sources: network and perimeter security devices, server and workstation operating systems, application components and APIs, cloud infrastructure components, as well as identity and access management systems. The environment also includes cryptographic components dedicated to processing payment transactions (hardware security modules), whose monitoring requires particular vigilance given their criticality.
🎯Your profile
Bac+5 degree in cybersecurity, IT, networks or an equivalent qualification
Minimum 7 years of proven experience in a similar role
Fluent French (C2), professional English (B2-C1)
📌 Key skills required
Technical skillsKnowledge of SOC tools: SIEM, EDR/xDR, SOAR (first operational experience is a plus).
Understanding of infrastructure logs (Active Directory, firewall, proxy, switch, virtualisation, Linux/Windows OS).
Awareness of Cloud/SaaS environments (Microsoft 365, Entra ID, Intune) and PaaS (Kubernetes/OpenShift).
Basics of incident analysis and reading network/system logs.
Knowledge of the MITRE ATT&CK framework; familiarity with PCI-DSS, NIST and ISO 27001 frameworks appreciated.
Analysis and qualification of security alerts.
Investigation of security incidents (level 2/3).
Writing clear reports and technical documentation.
Contribution to the continuous improvement of detection capabilities.
Rigour and analytical mindset.
Technical curiosity and ability to learn quickly, in an agile environment.
Autonomy and ability to work as part of a team.
Good communication skills, including with non-technical stakeholders.
Ability to thrive in a changing context, where tools and scope are built progressively.
💡 What we value
A product mindset: impact, user focus, lasting quality.
Ability to challenge and step back.
Curiosity: desire to learn and grow.
Job details
Location: Paris
Start date: As soon as possible
Contract type: Permanent (CDI)
Remote working: up to 10 days per month, within a limit of 3 days maximum per week.
Managerial (cadre) status
Pay & Benefits
Possibility of a CET (time savings account)
SWILE card (meal vouchers)
FMD (soft mobility allowance)
Employee savings: PEE, PERCO, profit-sharing, employer matching contributions
We operate under a quality approach and welcome every candidate with kindness and respect. As a reminder, this position is open to people with disabilities.
Finally, we place particular importance on our future employees acting with ethical and professional responsibility in their daily work. At any point during the recruitment process, the information in your CV, your identification details and your background may be verified.
See how well your CV fits this role. Log in or create a free account to check.