SIEM Detection Engineer (Remote)

About the role

Zama, an open-source cryptography company building fully homomorphic encryption solutions for blockchain, is looking for an experienced SIEM Detection Engineer to join its remote-friendly Security team. Based in Paris, the company is seeking someone to act as the engineer behind its web2 monitoring and alerting, helping catch threats earlier and respond faster.

Key responsibilities

• Lead the move from the initial SIEM to a more mature platform, evaluating options, driving the migration and designing for longer data retention and stronger monitoring and alerting.
• Integrate log sources across cloud, identity, endpoint, SaaS, network and application systems.
• Develop, tune and maintain detection rules, alerts and dashboards, and proactively hunt for threats and anomalies in logs.
• Build tooling, queries and automation (AI-assisted where helpful) to speed evidence collection, triage and response.
• Serve on the on-call rotation, investigating alerts, reconstructing timelines, preserving evidence and driving containment and remediation with system owners.
• Lead complex incidents and post-incident reviews, and collaborate with infrastructure and engineering teams to close telemetry gaps and shape security policies and documentation.
• Stay up to date on emerging threats, especially those targeting the crypto ecosystem.

Required profile

• 6+ years of hands-on experience in threat hunting, SIEM management, incident response and digital forensics, including leading incidents across teams.
• Experience building detection content for multiple SIEM platforms; having led a SIEM migration is a big plus.
• Strong knowledge of attacker behaviour and anomaly detection, with depth in identity, endpoint, cloud, network or application security.
• Exceptional English communication (C1 level); French is a plus.
• Bonus points for crypto or blockchain security experience, Terraform/Terragrunt automation, or an offensive security background (red teaming, pen testing, OSCP).

Required skills

• Solid SQL and log analysis, with Python and a track record of building tools for large, messy datasets.
• An established AI-assisted workflow and experience building AI-based systems for incident coordination and case management.