Senior Detection Engineer

• 3–6 years of hands-on experience in detection engineering, threat hunting, or incident response.
• At least three years of experience with at least one of: Elastic (SIEM/EDR), Suricata, Zeek.
• Demonstrable experience writing, tuning and validating detection logic in at least two of: Sigma, YARA‑L, ESQL.
• Strong understanding of detection deployment across the Detection Engineering Spectrum.
• Experience with telemetry sources and threat modelling.
• Comfortable working in a fast‑paced environment where threat‑driven detection and rapid iteration are the norm.
• Strong familiarity with MITRE ATT&CK and detection mapping of adversarial techniques.

As a Senior Detection Engineer you develop and implement advanced detection rules and monitoring solutions to quickly and effectively identify cyber threats. You build monitoring capabilities for network traffic, security logs, EDR/NDR data and OT environments. You also translate threat intelligence and Red Team reports into innovative detection options and coach your colleagues to promote knowledge sharing and stimulate innovation.

Do you want to play a key role in protecting the Netherlands? Apply as a Senior Detection Engineer and join us in our cutting‑edge, intelligence‑driven SOCs that are leading the way in automation and innovation. Your work will have a direct impact on the digital security of vital organisations.

For this position, candidates must be an EU resident and fluent in Dutch. We do not offer relocation packages for this position.

• Own the delivery of high‑quality detection content.
• Guide the Detection Engineering team on prioritisation, coverage and detection choke‑points.
• Partner with CTI and Red Teams and guide the process of converting regular assessments into refined detection strategies.
• Play a key role in shaping a comprehensive threat detection strategy aligned with business objectives and industry best practice.
• Mentor and support junior to medior detection engineers.
• Contribute to threat modelling efforts to identify high‑value detection opportunities and coverage gaps.
• Analyse telemetry sources (e.g. Windows Event Logs, Sysmon, cloud logs, network traffic) to identify detection use cases and ensure telemetry readiness.