Detection Engineer & Escalation Analyst (SIEM/EDR/SOAR)

Wlgroup; Henegouwen; Sur place; EUR 70 000 - 110 000; Plein temps

Résumé du poste

Mons, Belgium-based defence security operations centre seeks a technical escalation point to validate investigations, analyse logs and build detections that prevent repeat issues.

You'll mentor first-line analysts, participate in purple-team exercises, and work with Splunk, Microsoft Sentinel, and related tools to raise coverage and reduce false positives.

On-call duties accompany a 24x7 roster, with opportunity to shape detection content and run-books across the security stack.

Qualifications

• Hands-on SOC or monitoring experience with investigations.
• Expert-level ability to analyse complex security incidents and report findings.
• Fluency extracting and interrogating raw log data from varied sources.
• Experience with network capture tools (Wireshark, tcpdump, Zeek).
• Ability to translate attacker techniques into detections and write reviews.

Responsabilités

• Reviewing and validating investigations to ensure completeness and accuracy.
• Acting as the technical escalation point for security monitoring and triage.
• Providing on-call coverage as part of a 24x7 roster.
• Designing and maintaining detections, alerts, and analytics across tools.
• Mentoring analysts and providing feedback to improve techniques.
• Supporting purple-team exercises and threat hunting to improve coverage.

Connaissances

Security operations

Log analysis

Threat triage

Incident handling

On-call duties

Mentoring

Communication

Automation

Formation

Bachelor's degree in a related discipline

Five years of extensive and progressive expertise

Outils

Splunk

Microsoft Sentinel

Elastic Kibana

Wireshark

tcpdump

Zeek

Windows event logs

Sysmon

Defender/CrowdStrike

Description du poste

Mons, Belgium-based defence security operations centre seeks a technical escalation point to validate investigations, analyse logs and build detections that prevent repeat issues.

You'll mentor first-line analysts, participate in purple-team exercises, and work with Splunk, Microsoft Sentinel, and related tools to raise coverage and reduce false positives.

On-call duties accompany a 24x7 roster, with opportunity to shape detection content and run-books across the security stack.