At Mistral AI, we believe in the power of AI to simplify tasks, save time, and enhance learning and creativity. Our technology is designed to integrate seamlessly into daily working life.
We democratize AI through high-performance, optimized, open-source and cutting-edge models, products and solutions. Our comprehensive AI platform is designed to meet enterprise needs, whether on-premises or in cloud environments. Our offerings include le Chat, the AI assistant for life and work.
We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between France, USA, UK, Germany and Singapore. We are creative, low-ego and team-spirited.
Join us to be part of a pioneering company shaping the future of AI. Together, we can make a meaningful impact. See more about our culture on https://mistral.ai/careers.
We are looking for a SOC (Security Operations Center) Team Lead to build and lead our SOC function end-to-end. You will own vulnerability management, alerting and detection engineering, incident response, and the security tooling/infrastructure that enable these missions. You’ll define processes, collaborate closely with Product, Infra and IT, and continuously improve detection quality and response time.
Key missions & objectives: Establish a best-in-class SOC; reduce MTTA/MTTR; drive vulnerability remediation; raise detection coverage and precision; ensure robust incident handling and communication.
Reporting line: Reports to the Head of Security.
Location: Paris (on-site hybrid).
• Lead & grow the team: Manage the SOC team, shape the roadmap, delegate effectively, and mentor engineers.
• Drive operations:
• Engineering & enablement:
• Exercises & assurance: Coordinate red/blue exercises, post-mortems, and targeted audits to validate coverage and resilience.
• 5+ years of experience leading SOC/CSIRT functions, with proven incident leadership.
• Hands-on with SIEM (e.g., Elastic Security, Sekoia, Splunk) and SOAR platforms.
• Strong experience in vulnerability management (e.g., DefectDojo, Dependency-Track) and remediation workflows.
• Solid grasp of the cyber kill chain / attack lifecycle, detection engineering, and log source coverage.
• Excellent problem-solving and communication skills; able to operate in a fast-paced startup environment.
• Builder mindset: pragmatic, automation-oriented, comfortable with ambiguity and ownership.
Now, it would be ideal if you… (Nice to have)
• Introduction call (30 min)
• Technical Rounds:
• Hiring Manager (30 min)
• Value talk / Culture fit (30 min)
• References
This role is primarily based at one of our European offices (Paris, France and London, UK). We will prioritize candidates who either reside there or are open to relocating. We strongly believe in the value of in-person collaboration to foster strong relationships and seamless communication within our team.
In certain specific situations, we will also consider remote candidates based in one of the countries listed in this job posting — currently France & UK. In that case, we ask all new hires to visit our local office:
💰 Competitive salary and equity
🧑⚕️ Health insurance
🚴 Transportation allowance
🥎 Sport allowance
🥕 Meal vouchers
💰 Private pension plan
🍼 Parental : Generous parental leave policy
🌎 Visa sponsorship
