Security & DFIR Analyst

SecWise; Vlaams-Brabant; On-site; EUR 70,000 - 100,000; Full time

Job summary

SecWise is seeking a Senior Security & DFIR Analyst to lead escalated investigations and containment for our Managed SOC. You will own complex cases, perform threat hunts, and drive improvements in detections, runbooks, and incident response practices.

You’ll work with customers to understand compromises, reconstruct timelines, and document findings while coaching other analysts. This role is shift-based with three days in the office in Belgium.

Qualifications

• 5+ years in a SOC/IR/security role focusing on investigations.
• Solid DFIR experience including analyzing host/memory artifacts.
• Strong Microsoft security stack experience: Sentinel, Defender XDR, Entra ID.
• Proficient in writing and using KQL queries.

Responsibilities

• Lead escalated/high-impact investigations and containment.
• Conduct threat hunts and forensic analysis across incidents.
• Develop detections, runbooks and improve SOC processes.
• Coach analysts and provide guidance to improve investigations.
• Act as Incident Manager backup when needed.
• Contribute to monthly customer SOC reporting.

Skills

SOC/IR experience

DFIR experience

Microsoft Sentinel

Defender XDR

Entra ID

KQL queries

Dutch language

English language

Threat hunting

Incident response

Python/PowerShell

Azure basics

Tools

Microsoft Sentinel

PowerShell

Python

Azure

Job description

At SecWise, we’re looking for an experienced Senior Security & DFIR Analyst to strengthen our Managed SOC.

This isn’t a role where you’ll spend your days working through standard alerts. You’ll step in when investigations get complex, take technical ownership during major security incidents, hunt for threats others may have missed, and help raise the level of the wider SOC team.

Your main focus? Threat hunting, digital forensics and incident response.

Your role

As our Senior Security & DFIR Analyst, you’ll take the lead on escalated and high-impact security investigations. You’ll dig into what happened, understand the full scope of a compromise and work closely with customers to contain and resolve incidents.

At the same time, you’ll use what you learn to make our SOC stronger, from improving detections and runbooks to coaching other analysts.

What you’ll do

• Investigate and resolve complex cases escalated by our first-line analysts across Microsoft Sentinel, Defender XDR, Microsoft 365 and Azure


• Lead the technical investigation and response during major incidents, from scoping and containment to forensic analysis, timeline reconstruction and reporting


• Conduct proactive, hypothesis-driven threat hunts across our managed customers


• Turn your findings into better detections, tuned alerts and stronger runbooks


• Review investigations and coach analysts on approach, analysis and quality


• Act as backup Incident Manager when needed


• Contribute insights to monthly customer SOC reporting


• Spot gaps in security coverage, customer configurations or processes and take action to improve them

What you bring

• 5+ years of experience in a SOC, incident response or similar security role


• Solid hands-on DFIR experience, including investigating compromises, analysing host and memory artefacts, reconstructing timelines and documenting findings


• Strong experience with the Microsoft security ecosystem: Microsoft Sentinel, Defender XDR and Entra ID


• Confidence writing your own KQL queries to investigate and hunt


• A strong understanding of how attackers move through Microsoft 365 and Azure environments, including identity abuse, token theft, malicious mailbox rules, consent grants and endpoint-to-cloud lateral movement


• The ability to explain a complex compromise clearly, whether you’re speaking with another analyst or a customer’s IT manager


• A proactive mindset: you spot gaps and patterns and act on them rather than waiting for someone to ask


• Fluency in Dutch and English

Nice to have

• Experience in an MSSP or multi-customer SOC


• Certifications such as Microsoft SC-200, GIAC GCFA, GCFE or GCIH, or comparable DFIR credentials


• Experience with forensic acquisition and analysis tooling


• Hands-on threat-hunting experience


• Scripting skills in Python or PowerShell, or experience automating investigations with KQL


• Experience with SIEM or EDR platforms beyond the Microsoft ecosystem

Where you’ll fit

You’ll join the Operations Chapter within our Managed Security Services Tribe, working closely with our SOC analysts and the Engineering Chapter responsible for the detections, automations and customer onboardings that power our SOC.

You’ll report to the SOC Lead and have the opportunity to combine deep technical work with real influence on how we investigate incidents and continuously improve our security operations.

Practical

• This is a shift-based role


• One week of on-call per rotation, shared across the SOC analysts


• 3 days per week in the office

Ready to take the lead when things get serious?

Join SecWise and help us investigate, respond and continuously make our customers more resilient.