Mission Critical Security Engineer - Threat Hunting

schubergphilis; Schiphol-Rijk; On-site; EUR 70,000 - 110,000; Full time

Job summary

Schubergphilis is seeking a Mission Critical Security Engineer focused on Threat Hunting to join a dedicated customer team and secure a complex application landscape.

You will translate threat intel into practical detections using our MDR SIEM/SOAR platform, collaborating with the SOC and customer engineers to continuously improve detection coverage and response workflows across the environment.

Qualifications

• Solid engineering foundation in Linux, networks and infrastructure behavior.
• Hands-on experience with cloud platforms (AWS/Azure/others).
• Experience with CI/CD, Git and infrastructure-as-code tooling.
• Strong automation mindset and scalable problem solving.
• Experience with logs/telemetry analysis and scripting (Python/Bash).
• Familiarity with SIEM/log analytics tools like OpenSearch, Elastic or Splunk.

Responsibilities

• Threat intel & continuous improvement: translate developments into hunts and detections.
• Communication & advisory: clear, actionable communication to engineers and stakeholders.
• Detection engineering & threat hunting: develop and refine detection use cases for the environment.
• Use case development & response design: define actions when detections trigger and escalation paths.
• Platform collaboration: work with MDR platform and SOC to improve integrations and detection capabilities.

Skills

Linux

Networking

Threat hunting

Cloud environments

Python

Bash scripting

Automation mindset

Tools

CI/CD

Git

Infrastructure as Code

OpenSearch

Elastic

Splunk

Job description

Help protect what truly matters in our customers' most critical environments by proactively identifying threats and improving how they are detected and addressed.

As a Mission Critical Security Engineer with a focus on Threat Hunting, you will be part of a dedicated customer team responsible for securing and continuously improving a complex, mission-critical application landscape.

Working alongside other engineers and security specialists, you will help ensure the environment remains as secure and resilient as possible. You combine a strong engineering foundation with a security mindset, taking ownership of security improvements and understanding how systems, applications, and infrastructure behave.

Your specific focus will be on threat hunting and detection engineering. Using your in-depth knowledge of the customer's technology stack and application landscape, you will fine-tune existing detection use cases and develop new ones tailored to the environment. You will use our custom SIEM/SOAR-based Managed Detection and Response (MDR) platform to turn emerging threats and technical insights into actionable detection capabilities.

This role bridges security engineering, detection engineering, and threat intelligence. You don't simply follow predefined playbooks. You understand system behavior, identify gaps, and develop practical solutions that strengthen the security of the customer's environment.

/ What you will do

Threat intelligence & continuous improvement

• Actively follow security developments, vulnerabilities, and threat intelligence and translate these into relevant hunts and detections.
• Identify security risks and gaps in detection coverage and proactively propose improvements.
• Use your knowledge of the customer's application and infrastructure landscape to continuously strengthen its security posture.
• Contribute to the evolution of the team's security monitoring and detection strategy.

Communication & advisory

• Translate findings into clear, actionable communication for engineers, customer stakeholders, and security specialists.
• Contribute to security advisories and share relevant threats across the customer team and wider organization.
• Work closely with engineers to understand system behavior and validate detection strategies.
• Collaborate with the customer's Security Operations Center (SOC) to align security monitoring, threat detection, and response activities.
• Help establish and improve integrations with the customer's SIEM/SOAR platform, including the forwarding of relevant logs and security telemetry.

Detection engineering & threat hunting

• Develop and continuously improve detection use cases based on emerging threats and observed behavior.
• Translate threat scenarios and security insights into actionable detection logic tailored to the customer's environment.
• Proactively perform threat hunting across the application and infrastructure landscape to identify abnormal or suspicious patterns.
• Analyze logs and telemetry data to uncover behaviors that are not yet covered by existing detections.
• Use your understanding of the customer's technology stack to distinguish normal from potentially malicious behavior.

Use case development & response design

• Define what should happen when detections trigger, including response actions, automation, and escalation paths.
• Continuously refine detection logic to improve quality, relevance, and signal-to-noise ratio.
• Build and fine-tune custom detection scenarios based on the specific characteristics and security requirements of the customer's environment.

Platform collaboration

• Leverage our custom SIEM/SOAR-based MDR platform to implement detections and analyze data.
• Collaborate with platform and automation engineers to improve integrations and detection capabilities.
• Apply engineering and automation practices to ensure detection solutions are scalable, reliable, and maintainable.

/ What you bring

We are looking for someone who combines solid engineering fundamentals with a strong interest in security and is motivated to move towards or deepen their expertise in threat hunting and detection engineering.

You don't necessarily need to be an experienced threat hunter already. What matters is your ability to understand complex systems, recognize unusual behavior, and translate technical insights into practical security improvements.

Must-have skills

• Solid engineering fundamentals, including Linux, networking, and infrastructure behavior.
• Hands-on experience with cloud environments such as AWS, Azure, or similar platforms.
• Experience with CI/CD, Git, and configuration management or infrastructure-as-code tooling.
• Strong automation mindset and the ability to translate problems into scalable solutions.
• Experience working with logs and telemetry to analyze system behavior and investigate technical issues.
• Experience with Python and/or Bash scripting.
• Familiarity with SIEM or log analytics platforms such as OpenSearch, Elastic, Splunk, or