Mid-Level SOC Analyst (Microsoft Defender/Sentinel) – Hybrid

DEFION; Netherlands; Hybrid; EUR 60,000 - 90,000; Full time

Benefits offered by this job

Lease car

Mobility allowance

24 vacation days

Free lunch at the office

Hybrid work

Job summary

DEFION operates a Dutch-based SOC focusing on Microsoft Defender and Sentinel, with an international twin-SOC model for global client protection. You will join a highly technical, pragmatic team that collaborates with threat hunters, DFIR specialists, and analysts across borders in a hybrid role with on-call coverage.

You will investigate incidents, translate alerts into actionable client guidance, and contribute to playbooks and threat intel.

Qualifications

• Minimum 3 years in a Security Operations Center.
• Hands-on incident handling with Microsoft Defender and Microsoft Sentinel.
• MBO-4 or HBO level of working and thinking.
• Full proficiency in Dutch and English.
• Clear communication and structured working style.

Responsibilities

• Investigate and follow up on security incidents in Microsoft Defender and Microsoft Sentinel.
• Interpret alerts and translate them into clear reports and recommended actions for clients.
• Contribute to detection improvements, threat intelligence gathering, and playbook tuning.
• Support client onboarding and offboarding processes.
• Guide junior analysts and collaborate with threat hunters and incident responders across borders.
• Actively contribute ideas to make SOC processes smarter, faster, and better.

Skills

SOC experience

Incident handling

Dutch language

English language

Clear communication

Education

MBO-4 or HBO

Tools

Microsoft Defender

Microsoft Sentinel

Azure

CrowdStrike Falcon EDR

Job description

DEFION operates a Dutch-based SOC focusing on Microsoft Defender and Sentinel, with an international twin-SOC model for global client protection. You will join a highly technical, pragmatic team that collaborates with threat hunters, DFIR specialists, and analysts across borders in a hybrid role with on-call coverage.

You will investigate incidents, translate alerts into actionable client guidance, and contribute to playbooks and threat intel.