Mission Critical Security Engineer – Threat Hunting

Schuberg Philis; Haarlemmermeer; On-site; EUR 70,000 - 120,000; Full time

Job summary

Schuberg Philis is seeking a Mission Critical Security Engineer focused on Threat Hunting to join a dedicated customer team protecting a complex, mission-critical application landscape at Schiphol-Rijk. The role blends security engineering with detection engineering and threat intelligence, using a custom MDR platform to translate insights into effective detections.

You will collaborate with engineers and security specialists to strengthen security posture, tune detection use cases, and ensure

Qualifications

• Solid engineering fundamentals including Linux, networking and infrastructure behavior.
• Hands-on experience with cloud environments such as AWS, Azure, or similar.
• Experience with CI/CD, Git and configuration management or infrastructure-as-code tooling.
• Strong automation mindset with scalable solutions.
• Experience with logs and telemetry to analyze system behavior.
• Experience with Python and/or Bash scripting.
• Familiarity with SIEM or log analytics platforms (e.g. OpenSearch, Elastic, Splunk, Microsoft Sentinel).
• Strong understanding of security principles, including threat detection and response.
• Ability to distinguish normal from abnormal system behavior.
• Analytical, curious, and committed to security quality and improvement.
• Strong communication skills to translate findings into actionable insights.
• Ability to connect business and customer context to security solutions.

Responsibilities

• Threat intelligence & continuous improvement, translating threats into hunts and detections.
• Communicate findings clearly to engineers, stakeholders and security teams.
• Develop and refine detection use cases for the environment.
• Perform threat hunting to identify abnormal patterns and gaps in coverage.
• Define response actions and escalation paths for detections.
• Collaborate with platform and automation engineers to enhance integrations and capabilities.

Skills

Linux fundamentals

Networking

Cloud environments (AWS/Azure)

CI/CD & IaC tooling

Automation mindset

Logs & telemetry analysis

Python/Bash

SIEM/Log analytics

Threat detection & response

Analytical mindset

Ownership & communication

Business context to security solutions

Education

Bachelor's degree in Computer Science or related

Tools

OpenSearch

Elastic Stack

Splunk

Microsoft Sentinel

SOAR platforms

Job description

Mission Critical Security Engineer – Threat Hunting
Full-time Schiphol-Rijk 32-40 uur

Help protect what truly matters in our customers' most critical environments by proactively identifying threats and improving how they are detected and addressed.

As a Mission Critical Security Engineer with a focus on Threat Hunting, you will be part of a dedicated customer team responsible for securing and continuously improving a complex, mission-critical application landscape.

Working alongside other engineers and security specialists, you will help ensure the environment remains as secure and resilient as possible. You combine a strong engineering foundation with a security mindset, taking ownership of security improvements and understanding how systems, applications, and infrastructure behave.

Your specific focus will be on threat hunting and detection engineering. Using your in-depth knowledge of the customer's technology stack and application landscape, you will fine-tune existing detection use cases and develop new ones tailored to the environment. You will use our custom SIEM/SOAR-based Managed Detection and Response (MDR) platform to turn emerging threats and technical insights into actionable detection capabilities.

This role bridges security engineering, detection engineering, and threat intelligence. You don't simply follow predefined playbooks. You understand system behavior, identify gaps, and develop practical solutions that strengthen the security of the customer's environment.

/ What you will do

Threat intelligence & continuous improvement

• Actively follow security developments, vulnerabilities, and threat intelligence and translate these into relevant hunts and detections.
• Identify security risks and gaps in detection coverage and proactively propose improvements.
• Use your knowledge of the customer's application and infrastructure landscape to continuously strengthen its security posture.
• Contribute to the evolution of the team's security monitoring and detection strategy.

Communication & advisory

• Translate findings into clear, actionable communication for engineers, customer stakeholders, and security specialists.
• Contribute to security advisories and share relevant threats across the customer team and wider organization.
• Work closely with engineers to understand system behavior and validate detection strategies.
• Collaborate with the customer's Security Operations Center (SOC) to align security monitoring, threat detection, and response activities.
• Help establish and improve integrations with the customer's SIEM/SOAR platform, including the forwarding of relevant logs and security telemetry.

Detection engineering & threat hunting

• Develop and continuously improve detection use cases based on emerging threats and observed behavior.
• Translate threat scenarios and security insights into actionable detection logic tailored to the customer's environment.
• Proactively perform threat hunting across the application and infrastructure landscape to identify abnormal or suspicious patterns.
• Analyze logs and telemetry data to uncover behaviors that are not yet covered by existing detections.
• Use your understanding of the customer's technology stack to distinguish normal from potentially malicious behavior.

Use case development & response design

• Define what should happen when detections trigger, including response actions, automation, and escalation paths.
• Continuously refine detection logic to improve quality, relevance, and signal-to-noise ratio.
• Build and fine-tune custom detection scenarios based on the specific characteristics and security requirements of the customer's environment.

Platform collaboration

• Leverage our custom SIEM/SOAR-based MDR platform to implement detections and analyze data.
• Collaborate with platform and automation engineers to improve integrations and detection capabilities.
• Apply engineering and automation practices to ensure detection solutions are scalable, reliable, and maintainable.

/ What you bring

We are looking for someone who combines solid engineering fundamentals with a strong interest in security and is motivated to move towards or deepen their expertise in threat hunting and detection engineering.

You don't necessarily need to be an experienced threat hunter already. What matters is your ability to understand complex systems, recognize unusual behavior, and translate technical insights into practical security improvements.

Must-have skills

• Solid engineering fundamentals, including Linux, networking, and infrastructure behavior.
• Hands-on experience with cloud environments such as AWS, Azure, or similar platforms.
• Experience with CI/CD, Git, and configuration management or infrastructure-as-code tooling.
• Strong automation mindset and the ability to translate problems into scalable solutions.
• Experience working with logs and telemetry to analyze system behavior and investigate technical issues.
• Experience with Python and/or Bash scripting.
• Familiarity with SIEM or log analytics platforms such as OpenSearch, Elastic, Splunk, or Microsoft Sentinel.
• Strong understanding of security principles, including threat detection and response.
• Ability to distinguish normal from abnormal system behavior.
• Analytical, curious, and driven to understand how systems and threats behave.
• Ownership mindset, with responsibility for security quality and continuous improvement.
• Strong communication skills to translate technical findings into actionable insights.
• Ability to connect business and customer context to technical security solutions.

Nice-to-have skills

• Hands-on experience with threat hunting, detection engineering, or advanced SOC operations.
• Experience developing or improving detection use cases and security monitoring rules.
• Experience with SOAR or security automation.
• Deep knowledge of Microsoft Entra ID, Azure, and other Microsoft cloud services.
• Familiarity with threat intelligence frameworks such as MITRE ATT&CK.
• Experience integrating SIEM/SOAR platforms or forwarding security telemetry between different environments.

/ Who are you?

You are an engineer with a strong interest in security, driven to understand how systems behave and how threats manifest.

You don't follow playbooks blindly. You want to understand why detections exist, how systems interact, and where security can be improved.

You combine analytical thinking with a hands-on mindset and enjoy working with complex applications, infrastructure, and data. You are curious, proactive, and take ownership of the quality of your work.

You also enjoy being part of a customer team where security is a shared responsibility. You work closely with fellow engineers and security specialists, communicate clearly with stakeholders, and contribute to keeping the entire environment secure.

/ What can you expect?

At Schuberg Philis, you'll join a community of engineers with an awesome combination of exceptionally high security standards, an infatuation with automation, and the power to make a positive, sustainable impact on customers' business.

You'll work within a dedicated customer team where engineers and security specialists jointly take responsibility for the security and reliability of mission-critical environments.

Due to the nature of our customer engagements, there is no pressure on (billable) hours; we focus on quality and impact or how we like to call it: freedom & responsibility. You know best how to deliver the most value.

You'll be embedded in a company committed to helping colleagues grow as people and professionals through training, knowledge sharing, mentoring, and good old-fashioned fun.

Our offices are high-quality workspaces, and we go way beyond what is expected. We have productive equipment, good food and drinks, team outings, family days, labs to experiment with innovative technologies, etc.

We're active in relevant tech communities, attending and organizing meetups and conferences, and we organize internal knowledge-sharing events where Tech Leads play an important role.