Sr SOC Engineer

Senior SOC Engineer 📍 Amersfoort 💼 Hybrid & full-time 40 hours per week 🌍 EU authorisation required We're working with an established Dutch software company looking for a Senior SOC Engineer to take ownership of detection engineering, security monitoring and incident response across its cloud-native SaaS platform. About the company This business builds software that helps insurers, brokers and financial advisers manage contracts, process claims and automate their daily operations. It combines decades of insurance expertise with a modern cloud platform, connected through APIs and increasingly supported by AI. You’ll work in a regulated environment where protecting customer data and building reliable services directly matters to the businesses using the platform. What you'll do Working closely with the IT Security Lead and an external MDR partner, you’ll define the detection and response roadmap and turn it into a working capability. - Own telemetry coverage across AWS, endpoints, identity, applications and infrastructure. - Build, test and tune detection rules, improving coverage while reducing alert noise. - Develop incident response playbooks and automate triage and evidence collection. - Lead investigations, from initial scoping through containment and post-incident reporting. - Set escalation criteria with the MDR partner and run tabletop exercises. - Support ISAE 3000 assurance through technical controls, logging standards and audit evidence. What you’ll bring - 7+ years in security operations, incident response or detection engineering. - Hands-on experience developing SIEM detections and leading incident investigations. - Strong AWS security knowledge, including CloudTrail, GuardDuty, VPC Flow Logs and IAM. - Experience working with MDR or outsourced SOC partners. - Python, Bash or similar scripting skills, plus Infrastructure-as-Code and Detection-as-Code experience. - Familiarity with tools such as CrowdStrike, Elastic or AWS Security Lake, and telemetry across Windows, Linux and macOS. Experience securing containerised microservices, Spring Boot applications or working with application security tooling would be useful. What’s on offer - Fully employer-funded pension. - 27.5 days’ annual leave. - Hybrid working + home office budget. - Training, coaching and development opportunities. - The option to work temporarily from other countries. - Real ownership over the tools, processes and technical direction of security operations. Interested in hearing more? Send me a message and we can have a chat.