Hybrid Senior Security & DFIR Lead: Threat Hunting & IR

SecWise; Vlaams-Brabant; On-site; EUR 70,000 - 100,000; Full time

Job summary

SecWise is seeking a Senior Security & DFIR Analyst to lead escalated investigations and containment for our Managed SOC. You will own complex cases, perform threat hunts, and drive improvements in detections, runbooks, and incident response practices.

You’ll work with customers to understand compromises, reconstruct timelines, and document findings while coaching other analysts. This role is shift-based with three days in the office in Belgium.

Qualifications

• 5+ years in a SOC/IR/security role focusing on investigations.
• Solid DFIR experience including analyzing host/memory artifacts.
• Strong Microsoft security stack experience: Sentinel, Defender XDR, Entra ID.
• Proficient in writing and using KQL queries.

Responsibilities

• Lead escalated/high-impact investigations and containment.
• Conduct threat hunts and forensic analysis across incidents.
• Develop detections, runbooks and improve SOC processes.
• Coach analysts and provide guidance to improve investigations.
• Act as Incident Manager backup when needed.
• Contribute to monthly customer SOC reporting.

Skills

SOC/IR experience

DFIR experience

Microsoft Sentinel

Defender XDR

Entra ID

KQL queries

Dutch language

English language

Threat hunting

Incident response

Python/PowerShell

Azure basics

Tools

Microsoft Sentinel

PowerShell

Python

Azure

Job description

SecWise is seeking a Senior Security & DFIR Analyst to lead escalated investigations and containment for our Managed SOC. You will own complex cases, perform threat hunts, and drive improvements in detections, runbooks, and incident response practices.

You’ll work with customers to understand compromises, reconstruct timelines, and document findings while coaching other analysts. This role is shift-based with three days in the office in Belgium.