Ofertas › Schubergphilis

Security Engineer - MDR

Schubergphilis · Schiphol-Rijk

<blockquote>Shape how threats are detected before they become incidents and protect what truly matters in our customers’ most critical environments.</blockquote> As an MDR Threat Hunter, you are responsible for proactively identifying, analyzing, and translating emerging threats into actionable detection capabilities within mission-critical environments. You operate on top of a central MDR platform and continuously improve detection coverage by combining deep technical understanding with a strong security mindset. You play a key role in shaping how we detect and respond to threats: not by following predefined playbooks, but by understanding system behaviour, identifying gaps, and designing new detection use cases that matter.  This role bridges security engineering, detection engineering, and threat intelligence. You'll need curiosity, a sense of ownership, and the ability to turn abstract threats into practical detection logic in complex environments.This is a critical role in delivering high-quality, tailored detection and response capabilities for large, complex customer landscapes.  / What you will do  Detection engineering & threat hunting <ul> <li>Develop and continuously improve detection use cases based on emerging threats and observed behaviour.</li> <li>Translate threat scenarios and security insights into actionable detection logic.</li> <li>Proactively perform threat hunting on the environment to identify abnormal or suspicious patterns.</li> <li>Analyse logs and telemetry data to uncover behaviours that are not yet covered by existing detections.</li> </ul> Use case development & response design <ul> <li>Define what should happen when detections trigger (response actions, automation, escalation paths).</li> <li>Continuously refine detection logic to improve quality, relevance, and signal-to-noise ratio.</li> <li>Contribute to building custom detection scenarios tailored to customer environments.</li> </ul> Threat intelligence & continuous improvement <ul> <li>Actively follow security developments, vulnerabilities, and threat intelligence and translate these into new hunts and detections.</li> <li>Identify gaps in detection coverage and proactively propose improvements.</li> <li>Contribute to the evolution of the MDR detection strategy.</li> </ul> Communication & advisory <ul> <li>Translate findings into clear, actionable communication for engineers and stakeholders.</li> <li>Contribute to security advisories and share relevant threats across the organisation.</li> <li>Work closely with engineers to understand system behaviour and validate detection strategies.</li> </ul> Platform collaboration <ul> <li>Leverage the central MDR platform to implement detections and analyse data.</li> <li>Collaborate with platform/automation engineers to improve integrations and detection capabilities.</li> </ul> / What you bring   We are looking for someone who combines engineering fundamentals with a strong interest in security and is motivated to move towards or deepen expertise in threat hunting and detection engineering.  Must have skills: <ul> <li>Strong automation mindset and ability to translate problems into scalable logic.</li> <li>Experience working with logs, telemetry, and detection use cases.</li> <li>Solid engineering fundamentals (Linux, networking, infrastructure behaviour).</li> <li>Ability to distinguish normal vs. abnormal system behaviour.</li> <li>Experience with Python and/or Bash scripting.</li> <li>Familiarity with SIEM / log analytics platforms (e.g. OpenSearch, Elastic, Splunk, Sentinel).</li> <li>Strong understanding of security principles in detection and response.</li> <li>Analytical, curious, and driven to understand how systems and threats behave.</li> <li>Ownership mindset with responsibility for detection quality and coverage.</li> <li>Strong communication skills to translate findings into actionable insights.</li> <li>Ability to connect business context to detection logic.</li> </ul> Nice to have skills: <ul> <li>Experience with SOAR / security automation.</li> <li>Exposure to threat hunting, detection engineering, or advanced SOC.</li> <li>Experience with cloud environments (AWS, Azure or similar).</li> <li>Familiarity with CI/CD, Git, or configuration tooling.</li> </ul> / Who are you?  You are an engineer with a strong interest in security, driven to understand how systems behave and how threats manifest. You don’t follow playbooks blindly, you want to understand why detect

Que mi agente aplique