Security & DFIR Analyst

pAt bSecWise /b, we’re looking for an experienced bSenior Security DFIR Analyst /b to strengthen our Managed SOC. /p /brpThis isn’t a role where you’ll spend your days working through standard alerts. You’ll step in when investigations get complex, take technical ownership during major security incidents, hunt for threats others may have missed, and help raise the level of the wider SOC team. /p /brpYour main focus? bThreat hunting, digital forensics and incident response. /b /p /brh3Your role /h3 /brpAs our Senior Security DFIR Analyst, you’ll take the lead on escalated and high-impact security investigations. You’ll dig into what happened, understand the full scope of a compromise and work closely with customers to contain and resolve incidents. /p /brpAt the same time, you’ll use what you learn to make our SOC stronger, from improving detections and runbooks to coaching other analysts. /p /brh3What you’ll do /h3 /brul /brliInvestigate and resolve complex cases escalated by our first-line analysts across bMicrosoft Sentinel, Defender XDR, Microsoft 365 and Azure /b /li /brliLead the technical investigation and response during major incidents, from scoping and containment to forensic analysis, timeline reconstruction and reporting /li /brliConduct proactive, hypothesis-driven bthreat hunts /b across our managed customers /li /brliTurn your findings into better detections, tuned alerts and stronger runbooks /li /brliReview investigations and coach analysts on approach, analysis and quality /li /brliAct as backup bIncident Manager /b when needed /li /brliContribute insights to monthly customer SOC reporting /li /brliSpot gaps in security coverage, customer configurations or processes and take action to improve them /li /br /ul /brh3What you bring /h3 /brul /brlib5+ years of experience /b in a SOC, incident response or similar security role /li /brliSolid hands-on bDFIR experience /b, including investigating compromises, analysing host and memory artefacts, reconstructing timelines and documenting findings /li /brliStrong experience with the Microsoft security ecosystem: bMicrosoft Sentinel, Defender XDR and Entra ID /b /li /brliConfidence writing your own bKQL queries /b to investigate and hunt /li /brliA strong understanding of how attackers move through Microsoft 365 and Azure environments, including identity abuse, token theft, malicious mailbox rules, consent grants and endpoint-to-cloud lateral movement /li /brliThe ability to explain a complex compromise clearly, whether you’re speaking with another analyst or a customer’s IT manager /li /brliA proactive mindset: you spot gaps and patterns and act on them rather than waiting for someone to ask /li /brliFluency in bDutch and English /b /li /br /ul /brh3Nice to have /h3 /brul /brliExperience in an bMSSP or multi-customer SOC /b /li /brliCertifications such as bMicrosoft SC-200, GIAC GCFA, GCFE or GCIH /b, or comparable DFIR credentials /li /brliExperience with forensic acquisition and analysis tooling /li /brliHands-on threat-hunting experience /li /brliScripting skills in bPython or PowerShell /b, or experience automating investigations with KQL /li /brliExperience with SIEM or EDR platforms beyond the Microsoft ecosystem /li /br /ul /brh3Where you’ll fit /h3 /brpYou’ll join the bOperations Chapter within our Managed Security Services Tribe /b, working closely with our SOC analysts and the Engineering Chapter responsible for the detections, automations and customer onboardings that power our SOC. /p /brpYou’ll report to the bSOC Lead /b and have the opportunity to combine deep technical work with real influence on how we investigate incidents and continuously improve our security operations. /p /brh3Practical /h3 /brul /brliThis is a bshift-based role /b /li /brliOne week of on-call per rotation, shared across the SOC analysts /li /brlib3 days per week in the office /b /li /br /ul /brh3Ready to take the lead when things get serious? /h3 /brpJoin SecWise and help us investigate, respond and continuously make our customers more resilient. /p