Staff Security Operations Engineer

About the Position

Staff Security Operations Engineer

We’re a team of experts pushing the limits of what’s possible, united by our common goal to unlock true freedom through digital ownership, making technology accessible for all. We believe in a world where users, creators, and enterprises manage their value with ownership and freedom. Our curiosity drives us to innovate, empowering individuals on a global scale. We believe change is constant and our team moves forward as one, with a culture of problem-solving where every employee is empowered and supported to challenge tradition and create solutions. Our mission is simple: to make self-custody accessible and give people the keys to their own financial futures. If you want to make a true impact, we want you to join us at Ledger.

At Ledger, we’re proud to be the global platform for digital assets and Web3, with over 20% of the world’s crypto assets secured through our Ledger devices. With our headquarters in Paris, and offices in Vierzon, Grenoble, Montpellier, London, Portland, Geneva, Zurich, and Central Singapore, we have a team of around 600 professionals developing a variety of products and services to enable individuals and companies to securely buy, store, swap, grow, and manage crypto assets – including the Ledger hardware wallets line with more than 7.5 million units already sold in 200 countries.

Responsibilities

As a Staff Security Operations Engineer, you are the SecOps team’s top technical expert and our go-to authority on incident management. You will:

• Serve as the primary point of contact and coordinator for the most complex incidents across the cloud, corporate systems, endpoints, identities, and the data center.
• Conduct end-to-end investigations: root cause analysis, forensics, timeline reconstruction, and remediation recommendations to prevent recurrence.
• Define the team’s detection strategy, architecture, and methodology.
• Lead proactive threat hunting by leveraging CTI and OSINT to identify and neutralize risks before they impact Ledger.
• Design and optimize the SIEM (Splunk) architecture and SOAR (Torq) workflows that underpin effective detection, triage, and response.
• Build, evolve, and own the architecture of our internal Agentic SOC and our log/data pipeline, and lead the automation of reporting for the SecOps team.
• Establish the standards, playbooks, and runbooks that the team relies on.
• Mentor and foster the technical growth of senior and junior engineers, and act as a force multiplier within SecOps.

Requirements

• 9+ years of experience in security operations, incident response, and CSIRT.
• A strong track record as a technical expert in incident management, threat hunting, and detection engineering.
• In-depth expertise in SIEM (ideally Splunk) and SOAR platforms, as well as CTI/OSINT methodologies.
• Solid knowledge of AWS security (IAM, audit logs, network configurations, workloads, containers, Kubernetes) and cloud security tools (ideally Wiz, CSPM/CNAPP); experience with an EDR (ideally CrowdStrike).
• Strong incident response and forensics skills, with the ability to conduct complex end-to-end investigations.
• The ability to automate tasks and reporting using Python, Bash, APIs, GitHub Actions, a SOAR platform, or equivalent.
• A solid understanding of infrastructure (cloud, networking, containers, CI/CD) and the ability to build and scale: log/data pipelines, integrations, and internal services.
• Rigor and discipline: You follow and improve established processes and ensure consistency in incident handling and reporting; excellent analytical skills, even under pressure.
• Clear communication of complex technical concepts to cross-functional teams; ability to document thoroughly and escalate issues with the appropriate level of context; awareness of confidentiality and the proper handling of sensitive information.

Nice to Have

• A strong interest-or experience-in AI applied to security operations, agent-based workflows, and SOC automation.

We Offer

• Opportunity to work in a dynamic and innovative environment.
• Be part of a global team with a shared mission to empower individuals.
• Competitive compensation package.

About the Company

We’re a team of experts pushing the limits of what’s possible, united by our common goal to unlock true freedom through digital ownership, making technology accessible for all. We believe in a world where users, creators, and enterprises manage their value with ownership and freedom. Our curiosity drives us to innovate, empowering individuals on a global scale. We believe change is constant and our team moves forward as one, with a culture of problem-solving where every employee is empowered and supported to challenge tradition and create solutions. Our mission is simple: to make self-custody accessible and give people the keys to their own financial futures.