Want to know if this job is worth applying to?
Paris, Île-de-France, France
Hybrid
Equativ is an independent ad tech company. Our programmatic advertising platform runs at high scale, with production running entirely on Google Cloud Platform. Equativ is building its ISMS toward ISO 27001 certification target by the end of 2027. The SecOps team secures that platform and works with every team across Equativ.
You manage the SecOps team and own the day-to-day security operations of a full-cloud company. You build the team, grow its people and deliver the SecOps roadmap, which you define with the IT & Security lead.
You stay close to the technology: roughly 30% of your time is spent on people management and stakeholders, 70% on technical leadership and hands-on work during incidents and key projects.
People and team
Manage the SecOps engineers: 1:1s, objectives, annual reviews, CPF level assessments and career growth.
Run the team's rituals, plan and prioritize the SEC Jira backlog.
Represent SecOps in cross-team forums with R&D and Operations teams.
Report security operations KPIs and risks to the IT & Security lead.
Security operations
Define and enforce the GCP security baseline: organization policies, IAM and service-account hygiene, VPC Service Controls, KMS and Secret Manager.
Own cloud security posture with Wiz, and drive remediation with owning teams.
Own detection and response: log pipelines, SIEM use cases, alert quality, incident playbooks.
Lead security incidents end-to-end and run blameless post-mortems.
Run vulnerability management across cloud, containers, dependencies and external attack surface; track remediation SLAs.
Scope external pentests and follow findings through to remediation.
Embed security in the SDLC with R&D: threat modeling, SAST, SCA, secret and container scanning.
Own the operational evidence for the ISMS and ISO 27001 audit
Own the technical answers to security questionnaires and RFPs.
8+ years in security engineering or SecOps, including 3+ years securing production on a public cloud — GCP strongly preferred, AWS/Azure transferable.
2+ years managing a security team: hiring, reviews, coaching.
Strong GCP security knowledge: IAM model, org policies, VPC-SC, logging, GKE security.
Hands-on experience with modern cloud-native security platforms such as Google SecOps (Chronicle), Security Command Center (SCC), and Wiz (or similar CNAPPs).
Proven incident response leadership, including cloud incidents.
Experience running detection, vulnerability management and pentest programs.
Able to set priorities, say no and arbitrate between security risk and delivery.
Clear written and spoken English and French; able to explain risk to engineers, leadership and customers.
Kubernetes / GKE hardening and runtime security.
Experience in ad tech or other high-throughput, latency-sensitive platforms.
Exposure to ISO 27001 or SOC 2 audits from the operations side.
Identity and endpoint stack: Okta, Google Workspace, CrowdStrike.
Certifications: GCP Professional Cloud Security Engineer, CISSP, GCIH.
