Senior Security Engineer – Microsoft Sentinel & XDR

About the role

Do you enjoy turning complex security data into intelligent, automated defence? At Fox-IT (part of NCC Group), you’ll help leading organisations across the Netherlands strengthen their security posture using Microsoft’s security ecosystem. You’ll design and deliver Sentinel‑led detection and response, build smart SOAR automation, and shape XDR strategies that drive real impact.

Key responsibilities

• Microsoft Sentinel engineering: design, deploy and optimise Sentinel environments, including data connectors, normalisation, analytics rules, UEBA, watchlists, workbooks, and cost‑conscious ingestion strategies.
• Automation & SOAR: develop and implement pragmatic SOAR playbooks using Logic Apps and Power Automate to reduce manual effort and improve response times.
• XDR implementation: deploy and optimise Microsoft Defender XDR across endpoints, identity, email, and cloud, aligning detections with MITRE ATT&CK and relevant threat scenarios.
• Threat hunting & response: use KQL for proactive threat hunting, support incident triage, and continuously improve detection use cases in collaboration with SOC teams.
• Data protection & compliance: advise on Microsoft Purview, Information Protection, and DLP, supporting clients from design through to implementation and rollout.
• Client delivery: translate technical solutions into business value through roadmaps, reporting, and stakeholder communication.
• Knowledge sharing: support and mentor colleagues, contribute to reusable assets, and share best practices within Fox‑IT.
• Business development: support pre‑sales activities, including scoping, proposals, and advising clients on security strategy.

Required profile

• Strong experience delivering Microsoft Security solutions, especially Microsoft Sentinel (essential) and Microsoft Defender XDR.
• Solid skills in KQL, PowerShell scripting, and version control (Git).
• Proven consulting capability: client workshops, architecture design, stakeholder management and clear reporting.
• Professional fluency in Dutch and English (written and spoken).
• Understanding of security standards and frameworks (ISO 27001, NIST, GDPR) within a cloud context.

Required skills

• Microsoft Sentinel
• Microsoft Defender XDR
• Logic Apps
• Power Automate
• Microsoft Purview, Information Protection, DLP
• KQL
• PowerShell
• Git
• Azure cost optimisation
• ARM, Bicep, Terraform
• Entra ID, Conditional Access
• Microsoft Defender for Cloud, Intune
• MITRE ATT&CK mapping
• Incident response

What we offer

• Flexible working options to balance work and personal life.
• Generous holiday allowance: 25 days plus bank holidays, with the option to buy up to 5 additional days.
• Medicash & Critical Illness Scheme.
• Pension, Life Assurance and Share Save Scheme.
• Community and volunteering programmes.
• Green Car Scheme and Cycle‑to‑Work scheme.
• Special time off for major life events and family planning support, including generous maternity and paternity leave.