Experienced CTI Analyst - Cybersecurity - Toulouse
About the company
Sopra Steria, a major player in Tech in Europe, with 51,000 employees in nearly 30 countries, is recognized for its consulting, services, and digital solutions activities. It helps its clients lead their digital transformation and achieve concrete and lasting benefits. The Group provides a global response to the competitiveness challenges of large companies and organizations, by combining deep knowledge of business sectors and technologies with a collaborative approach. Sopra Steria places people at the heart of its action and is committed to its clients to make the most of digital technology to build a positive future. In 2025, the Group achieved a turnover of 5.6 billion euros..
**The world is how we shape it*** Sopra Steria (SOP) is listed on Euronext Paris (Compartment A) - ISIN Code: FR0000050809
The world is as we shape it _Sopra Steria's Cybersecurity Business Line is present in Europe with more than 2500 experts - more than half of whom are in France -, our mission is to provide trusted solutions and services to the most exposed public and private actors to ensure the resilience of their critical systems and protect their sensitive digital assets.___
_Beyond its strong European presence, the cybersecurity division is positioning and developing in North America (Toronto), as well as in Asia Pacific (Singapore).___
_We offer 3 domains of offerings: Prevention, Protection & detection and response. These 3 domains work together to provide our clients with homogeneous information and decision-making capabilities informed by operational reality. This approach is based on our transverse methodology centered on Mitre Att&ck.___
_Sopra Steria relies on proven and recognized sovereign capabilities to strengthen your resilience against cyberattacks and accelerate your digital transformation.___
- _An end-to-end trusted solution___
- _A "security by design" approach centered on business risks and transverse to the organization.___
- _A commitment to the development of innovative sovereign solutions.___
Each individual can have an impact on the response to these new cyber risk challenges. Everyone contributes both individually and collectively to securing our clients and society while maintaining their personal and professional growth.
Your tasks
As an Experienced CTI Analyst, you will be at the heart of adversary infrastructure monitoring, advanced threat hunting, and malware analysis activities used by attacker groups, particularly state-sponsored (APT). You will work in close collaboration with SOC, CERT, and Red Team teams to identify, qualify, and anticipate threats facing our clients.
Your role and missions Within the Cyber Threat Intelligence team, you will intervene in a multi-client context on various subjects such as:
Hunting & Monitoring of malicious infrastructures
- Leverage OSINT sources and specialized tools (Censys, Shodan, PassiveTotal, etc.) to map and monitor adversary infrastructures
- Identify and monitor C2, domains, and technical artifacts used by attackers
- Implement proactive detection methodologies based on network footprints and attribution techniques
Technical analysis and reverse engineering of malware
- Study malicious payloads used by APT groups (state-sponsored or advanced cybercriminals)
- Analyze "samples" via sandboxes, dynamic and static analysis.
- Identify the obfuscation, persistence, and communication mechanisms of malware
Production and enrichment of Threat Intelligence
- Transform technical information into actionable intelligence to improve detection and incident response
- Contribute to the enrichment of Threat Intelligence platforms (MISP, OpenCTI, etc.) and the dissemination of IoCs
- Develop detailed reports on attack campaigns, adversary TTPs (MITRE ATT&CK, MITRE ATLAS), and threat trends
Requirements
A graduate of an Engineering school or equivalent, you have at least 3 to 4 years of experience (excluding internship and apprenticeship experiences) in the field of cyber threat management CTI, and more specifically on SOC detection themes.
Your profile
- Graduate of an engineering school or equivalent, you have at least 3 to 4 years of experience (excluding internship and apprenticeship experiences) in the field of threat intelligence management (CTI) or on themes combining SOC detection and CTI
- Bilingual in English; additional linguistic skills such as Russian or Mandarin would be a plus
- Certifications in cybersecurity (for example, CISSP, CEH, GIAC) are a plus.
- You master threat intelligence tools and security platforms.
Key skills
- Advanced technical skills in threat hunting, OSINT, network analysis, and investigation of malicious infrastructures
- Experience in malware reverse engineering and good knowledge of PE and ELF formats, packers, and used languages (C/C++, Python, ASM)
- Good understanding of APT groups, their functioning, motivations, and infrastructure
- Experience with Threat Intelligence tools and CTI platforms (MISP, OpenCTI, Yara, Sigma, etc.)
- Ability to write clear and actionable reports, both for analysts and decision-makers
- Analytical mindset, autonomy, and curiosity for cybersecurity monitoring
The "plus" factors that will make a difference
- Experience in Threat Intelligence applied to TLPT (Threat-Led Penetration Testing)
- Knowledge of malicious protocols used by RATs and C2
- Ability to automate tasks via Python or other scripts
- Participation in conferences, CTFs, or open-source CTI projects
What we offer
What we offer you
- A teleworking agreement to work from home up to 2 days per week depending on your missions.
- An attractive benefits package: health insurance, CSE, restaurant vouchers, profit-sharing, holiday bonuses, and referral bonuses.
- Multiple career opportunities: more than 30 job families, as many gateways to imagine together.
- Hundreds of training courses to develop your skills and evolve within the Group.
- Self-paced training platforms to prepare for your certifications and support your personal development.
- The possibility to get involved with our foundation or our partner "Vendredi".
- The opportunity to join the Tech'Me UP collective (training, conferences, monitoring, and much more...).
Other
For more information, find us at www.soprasteria.com/fr
Additional information CDI- Toulouse- Analyst CTI, threat hunting, MISP, MITRE ATT&CK
An inclusive and committed employer, our company works every day to fight all forms of discrimination and promote a respectful working environment. This is why, committed to diversity and inclusion, we encourage all applications and all profiles.