Experienced Cyber Forensics Analyst - Incident Response (Digital Forensics and Incident Response) - Toulouse (M/F)

About the company

About Sopra Steria Sopra Steria, a major player in Tech in Europe, with 51,000 employees in nearly 30 countries, is recognized for its consulting, services, and digital solutions activities. It helps its clients lead their digital transformation and achieve concrete and lasting benefits. The Group provides a global response to the competitiveness challenges of large companies and organizations, by combining deep knowledge of business sectors and technologies with a collaborative approach. Sopra Steria places people at the heart of its actions and is committed to its clients to make the most of digital technology to build a positive future. In 2025, the Group achieved a turnover of 5.6 billion euros.

Sopra Steria's Cybersecurity Business Line is present in Europe with more than 2,500 experts - more than half of whom are in France -, our mission is to provide trusted solutions and services to the most exposed public and private actors to ensure the resilience of their critical systems and protect their sensitive digital assets. Beyond its strong European presence, the cybersecurity division is positioning and developing itself in North America (Toronto), as well as in Asia Pacific (Singapore).

We offer 3 domains of offerings: Prevention, Protection & detection and response. These 3 domains work together to provide our clients with homogeneous information and decision-making capabilities informed by operational reality. This approach is based on our transverse methodology centered on Mitre Att&ck.

Sopra Steria relies on proven and recognized sovereign capabilities to strengthen your resilience against cyberattacks and accelerate your digital transformation.

A trusted end-to-end solution A "security by design" approach centered on business risks and transverse to the organization. A commitment to developing innovative sovereign solutions.

Each individual can have an impact on the response to these new cyber risk challenges. Everyone contributes both individually and collectively to securing our clients and society while maintaining their personal and professional growth.

Your tasks

Within the Cybersecurity Division, you will join the Investigation product.

You will intervene on critical incidents, conduct advanced forensic investigations, and contribute to strengthening our clients' security posture.

Your role and missions

• You intervene quickly on major compromises (ransomware, APT, data exfiltration).
• You collect, preserve, and analyze digital evidence (disks, memory, logs, network artifacts) as part of advanced forensic analyses.
• You produce detailed technical reports and executive summaries for management.
• You develop DFIR playbooks, tools, and procedures in a logic of continuous improvement.
• You monitor emerging threats and contribute to threat intelligence.
• You work in collaboration with the SOC, network and cloud teams, and clients to coordinate actions.

Requirements

Your profile

• Graduate of an Engineering school or equivalent, you have at least 5 years of experience in DFIR or digital investigation.
• You demonstrate rigor, a sense of urgency, the ability to work under pressure, and clear communication.
• You have initiative, demonstrate autonomy on the subjects entrusted to you, and are rigorous and methodical.
• You like taking initiative, working in a team, and solving technical challenges. You are curious, a good communicator, with an interest in the cybersecurity field.
• You have a fluent level of English, both written and spoken.

Desired certifications: GCFA, GCFE, GCIH, CHFI, or equivalent.

Skills ...

What we offer

What we offer you

• A teleworking agreement to work from home up to 2 days per week depending on your missions.
• An attractive benefits package: health insurance, CSE, meal vouchers, profit-sharing, holiday bonuses, and referral bonuses.
• Multiple career opportunities: more than 30 job families, as many gateways to imagine together.
• Hundreds of training courses to develop your skills and evolve within the Group.
• Self-paced training platforms to prepare for your certifications and support your personal development.
• The possibility to get involved with our foundation or our partner "Vendredi".
• The opportunity to join the Tech'Me UP collective (training, conferences, monitoring, and much more).

Other

The world is how we shape it* Sopra Steria (SOP) is listed on Euronext Paris (Compartment A) - ISIN Code: FR0000050809 For more information, find us at www.soprasteria.com/fr *The world is as we shape it