Experienced Cyber Forensics Analyst – Incident Response (Digital Forensics and Incident Response) - Toulouse

About the company

Sopra Steria, a major player in Tech in Europe, with 51,000 employees in nearly 30 countries, is recognized for its consulting, services, and digital solutions activities. It helps its clients lead their digital transformation and achieve concrete and lasting benefits. The Group provides a global response to the competitiveness challenges of large companies and organizations, by combining deep knowledge of business sectors and technologies with a collaborative approach. Sopra Steria places people at the heart of its action and is committed to its clients to make the most of digital to build a positive future. In 2025, the Group achieved a turnover of 5.6 billion euros.

The world is how we shape it​ Sopra Steria (SOP) is listed on Euronext Paris (Compartment A) - ISIN Code: FR0000050809​

The world is as we shape it _Sopra Steria's Cybersecurity Business Line is present in Europe with more than 2500 experts - more than half of whom are in France -, our mission is to provide trusted solutions and services to the most exposed public and private actors to ensure the resilience of their critical systems and protect their sensitive digital assets.__​_

_Beyond its strong European presence, the cybersecurity division is positioning and developing in North America (Toronto), as well as in Asia Pacific (Singapore).__​_

Your tasks

_We offer 3 domains of offerings: Prevention, Protection & detection and response. These 3 domains work together to provide our clients with homogeneous information and decision-making capabilities informed by operational reality. This approach is based on our transverse methodology centered on Mitre Att&ck.__​_

_Sopra Steria is based on proven and recognized sovereign capabilities to strengthen your resilience against cyberattacks and accelerate your digital transformation.__​_

• _An end-to-end trusted solution__​_
• _A "security by design" approach centered on business risks and transverse to the organization.__​_
• _A commitment to the development of innovative sovereign solutions.__​_

Each individual can have an impact on the response to these new cyber risk challenges. Everyone contributes both individually and collectively to securing our clients and society while maintaining their personal and professional growth.

Within the Cybersecurity Division, you will join the Investigation product. You will intervene on critical incidents, conduct advanced forensic investigations, and contribute to strengthening our clients' security posture.

Your role and missions

• You intervene quickly on major compromises (ransomware, APT, data exfiltration).
• You collect, preserve, and analyze digital evidence (disks, memory, logs, network artifacts) as part of advanced forensic analyses.
• You produce detailed technical reports and executive summaries for management.
• You develop playbooks, tools, and DFIR procedures in a logic of continuous improvement.
• You monitor emerging threats and contribute to threat intelligence.
• You work in collaboration with the SOC, network and cloud teams, and clients to coordinate actions.

Requirements

Your profile

• Graduate of an Engineering school or equivalent, you have at least 5 years of experience in DFIR or digital investigation.
• You demonstrate rigor, a sense of urgency, the ability to work under pressure, and clear communication.
• You have initiative, demonstrate autonomy on the subjects entrusted to you, and are rigorous and methodical.
• You like taking initiative, working in a team, and solving technical challenges.
• You are curious, a good communicator, with an interest in the field of cybersecurity.
• You have a fluent level of English, both written and spoken.
• Desired certifications: GCFA, GCFE, GCIH, CHFI, or equivalent.

Key technical and functional skills

• You master Windows, Linux, macOS systems and cloud environments (Azure, AWS).
• You possess expertise in FTK, Splunk, Volatility tools.
• You are familiar with MITRE ATT&CK and NIST IR frameworks.
• You analyze SIEM logs, memory artifacts, registries, and application logs.
• You write scripts for automation (Python, PowerShell).
• You have a good understanding of network protocols and capture tools (Wireshark).

What we offer

What we offer you

• A teleworking agreement to telework up to 2 days per week depending on your missions.
• An attractive benefits package: health insurance, CSE, meal vouchers, profit-sharing, holiday and referral bonuses.
• Multiple career opportunities: more than 30 job families, as many gateways to imagine together.
• Hundreds of training courses to develop your skills and evolve within the Group.
• Self-paced training platforms to prepare for your certifications and support your personal development.
• The possibility to get involved with our foundation or our partner "Vendredi".
• The opportunity to join the Tech'Me UP collective (training, conferences, monitoring, and much more…).

Other

For more information, find us at www.soprasteria.com/fr​

Additional information CDI - Experienced Cyber Forensics Analyst - Île-de-France, Forensics, DFIR, MITRE ATT&CK

An inclusive and committed employer, our company works every day to fight against all forms of discrimination and promote a respectful working environment. This is why, committed to diversity and inclusion, we encourage all applications and all profiles.