Defensive Security Consultant

Crimson7; Brussel Hoofdstad; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Flexible working arrangements

Continuous learning and development

Job summary

Crimson7 is seeking a Defensive Security Consultant to help clients improve how they detect, investigate, and respond to adversary activity. You will combine hands-on detection engineering with practical guidance, working with Crimson7’s offensive and defensive practitioners to strengthen security in real environments.

You will assess client capabilities, fine-tune detection rules for SIEM/EDR, validate detections against realistic attack simulations, and collaborate with red team operators, SOC

Qualifications

• Experience in detection engineering, threat hunting, incident response, or security operations.
• Hands-on experience with at least one SIEM or EDR platform (e.g., Microsoft Sentinel, Splunk, Elastic).
• Experience writing or tuning detection logic and investigation queries (Sigma, KQL, SPL).
• Understanding MITRE ATT&CK framework and common attack techniques.

Responsibilities

• Assess client detection and response capabilities and define improvements.
• Develop and tune detection rules and hunting queries for SIEM/EDR.
• Validate detections using realistic attack simulations.
• Collaborate with red team, SOC, and client stakeholders to cover gaps.
• Explain findings and recommendations to technical and decision-makers.

Skills

Detection engineering

Threat hunting

Incident response

Security operations

Communication skills

Tools

Microsoft Sentinel

Splunk

Elastic

Sigma

KQL

SPL

Job description

We're looking for a Defensive Security Consultant to help clients improve how they detect, investigate, and respond to adversary activity. You'll combine hands-on detection engineering with practical guidance, working alongside Crimson7's offensive and defensive practitioners to make security capabilities more effective in real environments.

Responsibilities

• Assess client detection and response capabilities, then help define practical improvements
• Develop and tune detection rules and hunting queries for SIEM and EDR platforms
• Validate detections against realistic attack simulations and relevant adversary techniques
• Work with red team operators, SOC teams, and client stakeholders to investigate coverage gaps
• Support detection-as-code practices and help clients operationalize improvements
• Explain findings and recommendations clearly to technical teams and decision-makers

Requirements

• Experience in detection engineering, threat hunting, incident response, or security operations
• Hands-on experience with at least one SIEM or EDR platform, such as Microsoft Sentinel, Splunk, or Elastic
• Experience writing or tuning detection logic and investigation queries, such as Sigma, KQL, or SPL
• Understanding of common attack techniques and the MITRE ATT&CK framework
• Familiarity with endpoint, identity, network, or cloud telemetry
• Strong communication skills and a practical, collaborative approach to client work

Nice to Have

• Experience with detection-as-code or CI/CD workflows for security content
• Purple team, threat hunting, or incident response experience
• Scripting skills in Python or PowerShell
• Experience with cloud security telemetry or identity environments
• Offensive security background

What We Offer

• Work across offensive and defensive security engagements
• Collaborate with red team operators and client security teams
• Competitive salary and benefits
• Flexible working arrangements
• Continuous learning and development opportunities