Sr SOC Engineer

That Recruitment Company; Amersfoort; Híbrido; EUR 90.000 - 130.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Fully employer-funded pension

27.5 days' annual leave

Hybrid working + home office budget

Training, coaching and development

Opportunity to work temporarily from其他

Real ownership over security tools and

Descripción de la vacante

That Recruitment Company is partnering with a Dutch software company to hire a Senior SOC Engineer who will own detection engineering, security monitoring and incident response across its cloud-native SaaS platform. You will work with the IT Security Lead and an MDR partner to define the detection and response roadmap, build SIEM detections, and lead investigations across Windows, Linux and macOS.

The role also involves shaping tooling choices and contributing to ISAE 3000 assurance, with hybrid

Formación

• 7+ years of experience in security operations, incident response or detection engineering.
• Hands-on experience developing SIEM detections and leading incident investigations.
• Strong AWS security knowledge, including CloudTrail, GuardDuty, VPC Flow Logs and IAM.
• Experience working with MDR or outsourced SOC partners.
• Python, Bash or similar scripting skills, plus Infrastructure-as-Code and Detection-as-Code experience.
• Familiarity with tools such as CrowdStrike, Elastic or AWS Security Lake, and telemetry across Windows, Linux and macOS.

Responsabilidades

• Own telemetry coverage across AWS, endpoints, identity, applications and infrastructure.
• Build, test and tune detection rules, improving coverage while reducing alert noise.
• Develop incident response playbooks and automate triage and evidence collection.
• Lead investigations, from initial scoping through containment and post-incident reporting.
• Set escalation criteria with the MDR partner and run tabletop exercises.
• Support ISAE 3000 assurance through technical controls, logging standards and audit evidence.

Conocimientos

Security operations

Incident response

Detection engineering

SIEM

AWS security

Python

Bash

Infrastructure-as-Code

Detection-as-Code

CrowdStrike

Elastic

AWS Security Lake

Telemetry

Herramientas

CrowdStrike

Elastic

AWS Security Lake

Descripción del empleo

We're working with an established Dutch software company looking for a Senior SOC Engineer to take ownership of detection engineering, security monitoring and incident response across its cloud-native SaaS platform.

About the company

This business builds software that helps insurers, brokers and financial advisers manage contracts, process claims and automate their daily operations. It combines decades of insurance expertise with a modern cloud platform, connected through APIs and increasingly supported by AI.

You'll work in a regulated environment where protecting customer data and building reliable services directly matters to the businesses using the platform.

What you'll do

Working closely with the IT Security Lead and an external MDR partner, you'll define the detection and response roadmap and turn it into a working capability.

• Own telemetry coverage across AWS, endpoints, identity, applications and infrastructure.
• Build, test and tune detection rules, improving coverage while reducing alert noise.
• Develop incident response playbooks and automate triage and evidence collection.
• Lead investigations, from initial scoping through containment and post-incident reporting.
• Set escalation criteria with the MDR partner and run tabletop exercises.
• Support ISAE 3000 assurance through technical controls, logging standards and audit evidence.

What you'll bring

• 7+ years in security operations, incident response or detection engineering.
• Hands-on experience developing SIEM detections and leading incident investigations.
• Strong AWS security knowledge, including CloudTrail, GuardDuty, VPC Flow Logs and IAM.
• Experience working with MDR or outsourced SOC partners.
• Python, Bash or similar scripting skills, plus Infrastructure-as-Code and Detection-as-Code experience.
• Familiarity with tools such as CrowdStrike, Elastic or AWS Security Lake, and telemetry across Windows, Linux and macOS.

Experience securing containerised microservices, Spring Boot applications or working with application security tooling would be useful.

What's on offer

• Fully employer-funded pension.
• 27.5 days' annual leave.
• Hybrid working + home office budget.
• Training, coaching and development opportunities.
• The option to work temporarily from other countries.
• Real ownership over the tools, processes and technical direction of security operations.