Defensive Security Engineer & Threat Hunter

Crimson7; Brussel Hoofdstad; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Flexible working arrangements

Continuous learning and development

Job summary

Crimson7 is seeking a Defensive Security Consultant to help clients improve how they detect, investigate, and respond to adversary activity. You will combine hands-on detection engineering with practical guidance, working with Crimson7’s offensive and defensive practitioners to strengthen security in real environments.

You will assess client capabilities, fine-tune detection rules for SIEM/EDR, validate detections against realistic attack simulations, and collaborate with red team operators, SOC

Qualifications

• Experience in detection engineering, threat hunting, incident response, or security operations.
• Hands-on experience with at least one SIEM or EDR platform (e.g., Microsoft Sentinel, Splunk, Elastic).
• Experience writing or tuning detection logic and investigation queries (Sigma, KQL, SPL).
• Understanding MITRE ATT&CK framework and common attack techniques.

Responsibilities

• Assess client detection and response capabilities and define improvements.
• Develop and tune detection rules and hunting queries for SIEM/EDR.
• Validate detections using realistic attack simulations.
• Collaborate with red team, SOC, and client stakeholders to cover gaps.
• Explain findings and recommendations to technical and decision-makers.

Skills

Detection engineering

Threat hunting

Incident response

Security operations

Communication skills

Tools

Microsoft Sentinel

Splunk

Elastic

Sigma

KQL

SPL

Job description

Crimson7 is seeking a Defensive Security Consultant to help clients improve how they detect, investigate, and respond to adversary activity. You will combine hands-on detection engineering with practical guidance, working with Crimson7’s offensive and defensive practitioners to strengthen security in real environments.

You will assess client capabilities, fine-tune detection rules for SIEM/EDR, validate detections against realistic attack simulations, and collaborate with red team operators, SOC