Security Operations Engineer

Job Description

We are looking for a Security Operations Engineer to own day-to-day operational security for our EMEA region. You join a young regional Information Security function in a high-tech manufacturing business, working alongside the Regional Information Security Officer, who leads security governance, risk and compliance.

Our environment spans corporate IT, plants and OT systems across several countries, with central security services provided by our global HQ. Security here is risk-based and proportionate i.e. improvements are planned, prioritized and delivered through system owners, IT Operations and HQ Security, not by owning the systems yourself.

You will help build and mature our operational security processes rather than run an established SOC. Improvement work moves at the pace of change windows and production; incident response does not, and you will be the person who acts quickly when it counts.

Key responsibilities

Security monitoring and triage

• Act as EMEA's operational point of contact for HQ Security and its monitoring services like triage alerts, notifications and findings, route them to the right system owner and follow them through to evidenced closure.
• Use the security monitoring tools (SIEM, EDR/XDR, email security, Microsoft 365/Entra ID) to investigate suspicious activity in EMEA.
• Identify detection gaps for EMEA and define use cases and tuning requests for the centrally operated platforms.

Incident response

• Handle EMEA security incidents end to end including initial assessment, investigation, evidence collection, containment and coordination with HQ Security, IT Operations and the business.
• Build and maintain incident response runbooks for the most likely EMEA scenarios (e.g. account compromise, phishing and business email compromise, malware, supplier fraud).
• Analyze root causes, track remediation actions and prepare clear incident reports covering technical findings, impact and lessons learned.
• Provide the technical input for regulatory and customer notifications; the decision to notify seats with the Regional ISO, Legal and management

Vulnerability management

• Run the regional vulnerability management cycle: authenticated scanning, prioritization by risk, routing to owners and verification of remediation by rescan.
• Scope, coordinate and follow up external penetration tests.
• Keep endpoint protection and EDR coverage of the EMEA estate complete and healthy, working with IT Operations and HQ.

Security architecture and change review

• Review IT and network changes and new solutions from a security perspective and set security requirements, including input to the Change Advisory Board.
• Support IT Operations and network teams on firewalls, IDS/IPS, VPN and remote access by reviewing designs and validating that controls work as intended; implementation and operation remain with those teams.

Policies, compliance and audits

• Contribute to the regional ISMS led by the Regional ISO: technical input to standards and procedures, control testing and evidence.
• Support internal and external audits (e.g. ISO 27001, TISAX, NIS2) with technical evidence and follow up on corrective actions.

Customer compliance support

• Provide technical answers and evidence for customer security questionnaires and assessments, in coordination with the Regional ISO.

Awareness

• Support awareness activities such as phishing simulations and short, practical guidance for employees and IT staff.

How you will work with our tools

You will have investigation and search access to the security tools in scope for EMEA, plus defined containment actions for incidents (for example isolating an endpoint or revoking a compromised session) under agreed runbooks. Changes to security policies, detection rules and platform configuration are made together with HQ Security and through change management.

Qualifications

Education

• Bachelor’s degree in information security, Computer Science or a related field, or equivalent practical experience.

Experience

• 2 to 3 years in hands-on IT security operations, incident response or security engineering.
• Practical experience investigating incidents in Microsoft 365 / Entra ID and with EDR/XDR tools.
• Experience working in a multi-site or multinational organization, ideally in manufacturing, automotive or another industrial setting.

Skills

• Working knowledge of SIEM platforms (e.g. QRadar, Splunk, Sentinel) and log analysis.
• Hands-on experience with vulnerability scanning tools (e.g. Nessus, OpenVAS) and risk-based prioritization.
• Solid understanding of networks, Windows and Active Directory, firewalls, IDS/IPS and VPNs.
• Familiarity with ISO 27001, NIST CSF and the CIS Controls, and awareness of NIS2 and GDPR.
• Pragmatic and comfortable with incremental improvement; able to get things done through other teams without direct authority.
• Clear communicator in English, able to explain technical risk to non-technical colleagues and write clear incident reports.

Certifications (desirable)

• One or more operational certifications such as CompTIA Security+ or CySA+, Microsoft SC-200, GIAC GCIH or Blue Team Level 1.

Nice to have

• German, Dutch or another EMEA language.
• Exposure to OT/industrial environments (Purdue model, IEC 62443).
• Experience with Trend Micro Vision One or Microsoft Defender.

Additional Information

A challenging field of activity in a very motivated team, an international business environment and a customer focused company are waiting for you with lots of space for new ideas and to discover new paths! Use this opportunity and show us your motivation.

We are looking forward to hearing from you!