Security Engineer – Detection Engineering (MDR)

At Schuberg Philis security is part of engineering. It is not something we add afterwards.

As a Security Engineer – Detection Engineering (MDR), you’ll work in a dedicated customer team. Together, you are responsible for the security and reliability of a mission-critical IT environment.

• Full-time
• Schiphol-Rijk
• 32-40 uur

Your main focus is detection engineering. You’ll look at how systems work, where the risks lie, and what an attack could look like. From there, you develop detections tailored to the customer’s actual environment. That means working with logs and telemetry from infrastructure, cloud platforms, applications, networks, and identity services. You’ll use our SIEM/SOAR-based MDR platform to build and improve detections and response playbooks.

This is not a traditional SOC monitoring role. We’re looking for an engineer who wants to understand what is happening underneath an alert and improve how we detect it next time.

/ What you will do

• Develop a deep understanding of the customer’s IT landscape, to identify which systems and assets matter most.
• Be part of a dedicated customer team protecting the landscape of a specific customer.
• Identify security risks, attack paths, and gaps in existing monitoring.
• Build and maintain detection use cases in our MDR solution.
• Investigate logs and telemetry to understand suspicious activity.
• Test detections and fine-tune them to reduce false positives.
• Develop practical playbooks for investigation, escalation, and response. Test these playbooks with the rest of the team.
• Support security investigations and use what you learn to improve existing detections.
• Use threat intelligence (F.e. with MITRE ATT&CK) where they help improve detection coverage.
• Automate parts of the detection and response process where it makes sense.
• Work directly with cloud, infrastructure, application, and security engineers.
• Contribute to the centralized MDR solution of Schuberg Philis.

/ What you bring

You have a solid technical security background and understand how modern IT environments fit together.

You don’t need to know every technology we use, but you do need to be comfortable investigating systems you haven’t seen before.

We’re looking for:

• Hands-on experience with security monitoring and investigation.
• A good understanding of Windows and Linux, networking, identity, cloud, and applications.
• Experience working with logs, events, and security telemetry.
• Experience creating detections, monitoring rules, or investigation procedures.
• Experience with SIEM platforms such as Microsoft Sentinel, Elastic, OpenSearch, or similar.
• Strong analytical skills and a practical engineering mindset.
• The ability to work closely with engineers and directly with customer stakeholders like (functional-/technical) application managers, product owners or business users.

Experience with SOAR, threat hunting, incident response, Python, PowerShell, Bash, Azure, Entra ID, Kubernetes, or detection testing is useful, but not essential.

/ Who are you?

You’re curious! How can I better understand the environment and the risks? How can I get the best use cases in the system? If something looks suspicious, you seek to understand it. What happened? Which systems or identities were involved? What traces were left behind? And could we detect it earlier or more accurately next time?You enjoy investigating technical problems and building solutions. You are comfortable moving between security and engineering. You take ownership! When you find a gap, you don’t just report it. You help fix it.

Most importantly, you like working with others. Security at Schuberg Philis is a shared responsibility, not the job of a separate team somewhere else in the organisation. You will be part of the customer team focused on one (huge) customer. This will be your homebase.

/ What can you expect?

At Schuberg Philis, you’ll work with engineers who take real responsibility for mission-critical customer environments. We care more about quality and impact than billable hours. We call that freedom and responsibility. You have the room to decide how you can add the most value. You’ll also have plenty of opportunities to develop your expertise. Through training, mentoring, knowledge sharing, labs, meetups, conferences, and, most of all, working with experienced engineers.

If you enjoy understanding complex environments and building security detections that work in practice, we’d like to hear from you.