> Markdown version of [/jobs/ext/4708728-security-engineer-detection-engineering-mdr](https://www.wearedevelopers.com/jobs/ext/4708728-security-engineer-detection-engineering-mdr). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer - Detection Engineering (MDR) - **Company:** Schuberg Philis - **Location:** Schiphol-Rijk, Netherlands - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Microsoft Azure, Bash Shell, Cloud Computing, Linux, Intrusion Detection and Prevention, Python (Programming Language), Windows PowerShell, Security Information and Event Management, Mitre Att&ck, Kubernetes, Cybercrime, Microsoft Sentinel, OpenSearch, Security Orchestration, Automation & Response - **Published:** November 14, 2026 - **Apply:** https://www.adzuna.nl/details/5964795695 ## About the Role * Hands-on experience with security monitoring and investigation. * A good understanding of Windows and Linux, networking, identity, cloud, and applications. * Experience working with logs, events, and security telemetry. * Experience creating detections, monitoring rules, or investigation procedures. * Experience with SIEM platforms such as Microsoft Sentinel, Elastic, OpenSearch, or similar. * Strong analytical skills and a practical engineering mindset. * The ability to work closely with engineers and directly with customer stakeholders like (functional-/technical) application managers, product owners or business users. Experience with SOAR, threat hunting, incident response, Python, PowerShell, Bash, Azure, Entra ID, Kubernetes, or detection testing is useful, but not essential. / Who are you? You're curious! How can I better understand the environment and the risks? How can I get the best use cases in the system? If something looks suspicious, you seek to understand it. What happened? Which systems or identities were involved? What traces were left behind? And could we detect it earlier or more accurately next time? You enjoy investigating technical problems and building solutions. You are comfortable moving between security and engineering. You take ownership! When you find a gap, you don't just report it. You help fix it. ## Description As a Security Engineer focusing on Detection Engineering (MDR), you'll work in a dedicated customer team. Together, you are responsible for the security and reliability of a mission-critical IT environment. Your main focus is detection engineering. You'll look at how systems work, where the risks lie, and what an attack could look like. From there, you develop detections tailored to the customer's actual environment. That means working with logs and telemetry from infrastructure, cloud platforms, applications, networks, and identity services. You'll use our SIEM/SOAR-based MDR platform to build and improve detections and response playbooks. This is not a traditional SOC monitoring role. We're looking for an engineer who wants to understand what is happening underneath an alert and improve how we detect it next time. / What you will do * Develop a deep understanding of the customer's IT landscape, to identify which systems and assets matter most. * Be part of a dedicated customer team protecting the landscape of a specific customer. * Identify security risks, attack paths, and gaps in existing monitoring. * Build and maintain detection use cases in our MDR solution. * Investigate logs and telemetry to understand suspicious activity. * Test detections and fine-tune them to reduce false positives. * Develop practical playbooks for investigation, escalation, and response. Test these playbooks with the rest of the team. * Support security investigations and use what you learn to improve existing detections. * Use threat intelligence (F.e. with MITRE ATT&CK) where they help improve detection coverage. * Automate parts of the detection and response process where it makes sense. * Work directly with cloud, infrastructure, application, and security engineers. * Contribute to the centralized MDR solution of Schuberg Philis. / What you bring You have a solid technical security background and understand how modern IT environments fit together. You don't need to know every technology we use, but you do need to be comfortable investigating systems you haven't seen before.