Cyber Threat Hunter

Forensic Focus Limited; Utrecht; Hybrid; EUR 66,000 - 91,000; Full time

Job summary

Forensic Focus Limited seeks a Lead/Principal Cyber Threat Hunter for a national defence cyber security centre in Zeist, Utrecht, Netherlands. You will proactively hunt for advanced threats across military IT infrastructure, analyze activity, and deploy modern tooling to identify attacks at an early stage—both remotely and on-site.

This senior role requires at least five years in digital forensics and cybersecurity, with GCFA/GNFA/GREM/GASF certifications, and strong scripting in Python or

Qualifications

• Minimum 5 years in digital forensics and cybersecurity.
• GCFA/GNFA/GASF or GREM certifications required.
• Strong networking, malware analysis, and multi-OS expertise.
• Proficient in Python or PowerShell scripting.
• Experience with forensic tooling and CRRT.

Responsibilities

• Lead threat-hunting activities across national defence IT environments.
• Analyse suspicious activity and develop detection methods.
• Deploy modern tooling to identify attacks at an early stage.
• Mentor colleagues and communicate findings clearly under pressure.
• Operate in a security-cleared government setting, on-site or remotely.

Skills

Digital forensics

Cybersecurity

Networking

Malware analysis

Scripting (Python/PowerShell)

Forensic tooling

CRRT

GCFA

GNFA

GREM

GASF

Tools

GCFA

GNFA

GREM

GASF

Job description

# Cyber Threat Hunter*Ministerie van Defensie***Zeist, Utrecht**Hybrid · Lead/Principal · Full-time### The RoleWorking within a dedicated DFIR team at a national defence cyber security centre, the role involves proactively hunting for advanced digital threats across military IT infrastructure. Day-to-day responsibilities include analysing suspicious activity, developing detection methods, and deploying modern tooling to identify attacks at an early stage — both remotely and on-site.### Skills & ExperienceCandidates require at least five years of experience in digital forensics and cybersecurity, alongside relevant SANS/GIAC certifications such as GCFA, GNFA, GASF or GREM. Strong knowledge of networking, malware analysis, multiple operating systems, and scripting in Python or PowerShell is expected. Experience in forensic tooling and CRRT is also required.### Who It SuitsThis lead-level position suits an experienced digital forensics and threat-hunting professional comfortable operating in a high-stakes, security-cleared government environment. The role is well suited to someone who can mentor colleagues, communicate findings clearly, and thrive under pressure within a team protecting national security infrastructure.Typical advertised salary forIncident Response roles in Netherlands:**€66,000–€91,000**(median €78,000 — from16 recent listings analysed by Forensic Focus).Compare Incident Response salaries in Netherlands →Certifications mentioned:GCFA · GREM · GNFA · SANS · GASF — find training for these on theDFIR Training Finder.Learn More/Apply