Senior SOC Analyst: Detection Engineering & Triage

Wlgroup; Henegouwen; Sur place; EUR 70 000 - 95 000; Plein temps

Résumé du poste

Wlgroup is seeking a Technical Escalation Point in Mons, Belgium to validate investigations, perform in-depth log analysis, and develop detections that reduce repeat incidents. You will work across Splunk Enterprise Security, Splunk SOAR and Microsoft Sentinel, and participate in purple-team exercises to strengthen monitoring coverage.

You will provide 24x7 on-call support, mentor junior analysts, and contribute to process improvements while writing clear investigation notes and run-books.

Qualifications

• Hands-on in a security operations centre or closely related monitoring environment.
• Expert-level record of analysing complex security incidents and writing clear, authoritative reports and recommendations.
• Fluency extracting, normalising and interrogating raw log data from Windows, Linux, Sysmon, Defender, SentinelOne or CrowdStrike using Splunk, Microsoft Sentinel or Elastic Kibana.
• Hands-on packet capture analysis with Wireshark, tcpdump or Zeek.
• Ability to turn attacker techniques and threat intelligence into working detection logic and run peer reviews of investigations.
• Designing, developing and maintaining detections across monitoring, endpoint and cloud security tooling.
• Mentoring less experienced analysts with constructive feedback.
• Automation to reduce repetitive manual tasks.

Responsabilités

• Reviewing and validating investigations, supporting first-line analysts to ensure closures are complete and sound.
• Acting as the technical escalation point for security monitoring across Splunk, Sentinel, and related sources.
• Providing on-call cover as part of a 24x7 roster.
• Designing, testing and maintaining detection rules, alerts and analytics.
• Giving regular feedback and coaching to analysts and helping new joiners.
• Supporting the duty second-line analyst through the week and ensuring service continuity
• Participating in purple-team exercises to improve detection coverage
• Collaborating with threat hunting to automate detections where possible
• Contributing to service improvements by identifying workflow bottlenecks and blind spots
• Writing and updating operational documentation and run-books
• Representing monitoring in project planning and security-tool configuration
• Collaborating with broader security teams and external partners
• Ad-hoc investigations and projects as needed

Connaissances

SOC operations

Log analysis

Threat triage

Splunk

Microsoft Sentinel

On-call support

Documentation

Automation

English proficiency

Formation

Bachelor's degree in a related discipline

Five years of extensive and progressive expertise

Outils

Wireshark

tcpdump

Zeek

Kibana

Description du poste

Wlgroup is seeking a Technical Escalation Point in Mons, Belgium to validate investigations, perform in-depth log analysis, and develop detections that reduce repeat incidents. You will work across Splunk Enterprise Security, Splunk SOAR and Microsoft Sentinel, and participate in purple-team exercises to strengthen monitoring coverage.

You will provide 24x7 on-call support, mentor junior analysts, and contribute to process improvements while writing clear investigation notes and run-books.