Senior Security Engineer

Do you enjoy turning complex security data into intelligent, automated defence? At Fox-IT (part of NCC Group), you’ll help leading organisations across the Netherlands strengthen their security posture using Microsoft’s security ecosystem. You’ll design and deliver Sentinel-led detection and response, build smart SOAR automation, and shape XDR strategies that drive real impact. This is hands-on consultancy work in a collaborative environment that values innovation, knowledge sharing, and high-quality delivery. Microsoft Sentinel engineering: Design, deploy and optimise Sentinel environments, including data connectors, normalisation, analytics rules, UEBA, watchlists, workbooks, and cost-conscious ingestion strategies Automation & SOAR: Develop and implement pragmatic SOAR playbooks using Logic Apps and Power Automate to reduce manual effort and improve response times XDR implementation: Deploy and optimise Microsoft Defender XDR across endpoints, identity, email, and cloud. Align detections with MITRE ATT&CK and relevant threat scenarios Threat hunting & response: Use KQL for proactive threat hunting, support incident triage, and continuously improve detection use cases in collaboration with SOC teams Data protection & compliance: Advise on Microsoft Purview, Information Protection, and DLP, supporting clients from design through to implementation and rollout Client delivery: Translate technical solutions into business value through roadmaps, reporting, and stakeholder communication Knowledge sharing: Support and mentor colleagues, contribute to reusable assets, and share best practices within Fox-IT Business development: Support pre-sales activities, including scoping, proposals, and advising clients on security strategy Strong experience delivering Microsoft Security solutions, including: Microsoft Sentinel (essential) Microsoft Defender XDR SOAR (Logic Apps / Power Automate) Purview / DLP Solid skills in KQL, scripting (PowerShell), and version control (Git) Experience with cost optimisation in Azure (ingestion, retention, table selection) Proven Consulting Capability: Client workshops Architecture design Stakeholder management Clear and structured reporting Understanding of security standards and frameworks (ISO 27001, NIST, GDPR) within a cloud context Language requirement: Professional fluency in Dutch and English (written and spoken) Nice-to-have Skills: Infrastructure as Code (ARM, Bicep, Terraform) Entra ID and Conditional Access Microsoft Defender for Cloud, Intune MITRE ATT&CK mapping Incident response experience Certifications such as SC-200, SC-100, CISSP, CISM, ISO 27001 Ways of Working: Focusing on Clients and Customers. Working as One NCC. Always Learning. Being Inclusive and Respectful. Delivering Brilliantly.