Senior SOC Engineer – Microsoft Security Stack
About the assignment
A leading global retail organisation is building out its European SOC function and needs a senior technical leader to drive it forward. You'll sit at the heart of a group-level security operations centre, owning complex incident investigations and setting the standard for threat detection across the entire organisation.
Your impact extends beyond day-to-day firefighting. You'll onboard new operating companies into the SOC service, standardise detection rules and workflows across the group, and elevate the capability of the entire team through knowledge transfer and training.
Your responsibilities
- Lead cybersecurity incidents end-to-end, from identification through investigation to post-incident review
- Conduct advanced threat hunting across Microsoft Defender XDR, Microsoft Sentinel and KQL
- Develop, tune and maintain Sentinel analytics rules, workbooks and automation playbooks
- Build automation via Logic Apps, SOAR workflows and PowerShell scripts
- Onboard new operating companies into the SOC service, aligning detection coverage and severity mappings
- Deliver knowledge transfer and training to SOC analysts and business stakeholders
- Act as escalation point for L1 and L2 analysts on complex or critical incidents
Tech Stack & Tools
Platforms & Tooling
Frameworks & Standards
Cloud & Infrastructure
Methodologies
Certifications (preferred)
Must-haves
- 5+ years hands-on experience in security operations, incident response or threat detection
- Strong expertise with Microsoft Sentinel, Defender XDR and KQL
- Deep knowledge of Microsoft 365 Security, Entra ID and cloud security architecture
- Proven ability to design and tune detection rules and analytics
- Excellent communication skills and comfort working across distributed teams
- Experience onboarding or scaling security operations across multiple entities
Nice-to-haves
- Microsoft security certifications (SC-200, SC-300, SC-100, AZ-500)
- Hands-on SOAR or scripting experience (PowerShell, Python)
- Track record leading or mentoring SOC analysts
What we offer
- Lead and shape security operations at group level across multiple European companies
- Work with a modern Microsoft security stack at scale
- Fully remote role based from Utrecht HQ
- Opportunity to standardise and improve detection engineering across an entire organisation
- Mentor and develop junior analysts as the SOC grows
- Personal guidance from a dedicated MVPeople consultant who knows your niche
The process
Introduction
Phone call with your MVPeople consultant (within 24 hours)
Match & Brief
We discuss the assignment in detail and prepare you
Client meeting
Introduction to the client
Start
Contracting and onboarding
Details
Type
Permanent (MVPermanent)
Location
Utrecht, UT
Work model
Hybrid
Level
Senior
Industry
retail
Market indication
€65,000 - €85,000 per year
Posted
11 July 2026
Job ID
56389
Contact
MVPeople Group
jobs@mvpeoplegroup.com