Cybersecurity Engineer (Incident Response Lead)

Mistral AI is looking for a senior Incident Response and Digital Forensics specialist to lead our incident response capability across a complex, rapidly evolving AI ecosystem

• Reporting to the SOC Lead, you will take end-to-end ownership of major security incidents, from initial investigation and containment through remediation and post-incident improvement. During critical events, you will act as the incident commander, bringing structure, sound judgment, and calm leadership to high-pressure situations
• This is a hands-on, player‑coach position combining deep technical investigations with capability building. You will help define our incident response methodology, forensic tooling, runbooks, exercises, and post‑mortem practices. As the organization grows, the role may also offer opportunities to build and lead a dedicated incident response team
• Own the incident response lifecycle for high‑severity security events, including triage, investigation, containment, remediation, recovery, and post‑incident review
• Act as incident commander, coordinating technical teams and key stakeholders during complex security incidents
• Build, maintain, and test incident response runbooks covering Mistral’s most important risk scenarios
• Develop and operate forensic capabilities across cloud, containerized, on‑premises, and endpoint environments
• Preserve, collect, and analyze digital evidence using rigorous and repeatable forensic methodologies
• Partner with SOC and Detection Engineering teams to strengthen detection‑to‑response workflows and improve investigative readiness
• Design and facilitate tabletop exercises with engineering, legal, communications, and leadership stakeholders
• Lead blameless post‑mortems and ensure lessons learned translate into durable technical and organizational improvements
• Define clear incident communication and escalation practices for both technical and non‑technical stakeholders
• Contribute to the long‑term development of Mistral’s incident response function, with the potential to mentor or lead future team members
• Level: Senior / Staff

Benefits

• Competitive bonus structure
• Equity
• Opportunities for professional growth and development

Qualifications

• Hands‑on experience with endpoint forensics, ideally including macOS environments
• Strong knowledge of cloud and container forensics, including environments such as AWS, GCP, Kubernetes, and on‑premises infrastructure
• A calm, methodical, and pragmatic approach, combined with a strong sense of ownership
• Demonstrated ability to take command during critical incidents and coordinate multidisciplinary teams under pressure
• Ability to automate investigative or response workflows using Python, Go, or similar languages
• Strong understanding of attacker behaviors, investigation methodologies, evidence handling, and the MITRE ATT&CK framework
• Excellent written and verbal communication skills, with the ability to communicate clearly with engineers, legal teams, executives, and other stakeholders
• Experience mentoring others or helping build an incident response capability is highly valued
• Experience building incident response runbooks, forensic workflows, tabletop exercises, and post‑incident review practices
• Significant experience leading complex incident response and digital forensics investigations in cloud‑native, technology, or similarly high‑stakes environments