Senior SOC Engineer: Lead Detection & IR (Hybrid)

That Recruitment Company; Amersfoort; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Fully employer-funded pension

27.5 days' annual leave

Hybrid working + home office budget

Training, coaching and development

Opportunity to work temporarily from其他

Real ownership over security tools and

Job summary

That Recruitment Company is partnering with a Dutch software company to hire a Senior SOC Engineer who will own detection engineering, security monitoring and incident response across its cloud-native SaaS platform. You will work with the IT Security Lead and an MDR partner to define the detection and response roadmap, build SIEM detections, and lead investigations across Windows, Linux and macOS.

The role also involves shaping tooling choices and contributing to ISAE 3000 assurance, with hybrid

Qualifications

• 7+ years of experience in security operations, incident response or detection engineering.
• Hands-on experience developing SIEM detections and leading incident investigations.
• Strong AWS security knowledge, including CloudTrail, GuardDuty, VPC Flow Logs and IAM.
• Experience working with MDR or outsourced SOC partners.
• Python, Bash or similar scripting skills, plus Infrastructure-as-Code and Detection-as-Code experience.
• Familiarity with tools such as CrowdStrike, Elastic or AWS Security Lake, and telemetry across Windows, Linux and macOS.

Responsibilities

• Own telemetry coverage across AWS, endpoints, identity, applications and infrastructure.
• Build, test and tune detection rules, improving coverage while reducing alert noise.
• Develop incident response playbooks and automate triage and evidence collection.
• Lead investigations, from initial scoping through containment and post-incident reporting.
• Set escalation criteria with the MDR partner and run tabletop exercises.
• Support ISAE 3000 assurance through technical controls, logging standards and audit evidence.

Skills

Security operations

Incident response

Detection engineering

SIEM

AWS security

Python

Bash

Infrastructure-as-Code

Detection-as-Code

CrowdStrike

Elastic

AWS Security Lake

Telemetry

Tools

CrowdStrike

Elastic

AWS Security Lake

Job description

That Recruitment Company is partnering with a Dutch software company to hire a Senior SOC Engineer who will own detection engineering, security monitoring and incident response across its cloud-native SaaS platform. You will work with the IT Security Lead and an MDR partner to define the detection and response roadmap, build SIEM detections, and lead investigations across Windows, Linux and macOS.

The role also involves shaping tooling choices and contributing to ISAE 3000 assurance, with hybrid