Lead Security Analyst

Wat ga je doen?

As our Lead Security Analyst, you’ll play a key role in securing our Microsoft environment (including Azure, Entra ID, and IAM), while also working on broader topics like incident response, tooling improvements, and DDOS investigations.

We’re currently moving to a new Microsoft tenant, which means you’ll help shape security from the ground up. This includes defining how access is managed, working closely with the Workspace Management (WSM) team, and supporting the rollout of new security controls and monitoring tools.

You’ll collaborate closely with our other Security Analysts and subject matter experts to strengthen detection and response and help support our future SOC capabilities and i3D’s overall security program.

• Ownership of securing our environment from the physical layer all the way up to application: Help design and improve the security of our Azure tenant, Entra ID, and identity and access setup.
• Partner with the Workspace Management (WSM) team: You’ll guide protecting employees, endpoints and tools. Coordinate with the team that manages rights, starters, movers, and leavers, so access stays under control and risks are caught early.
• Tracking, and handling escalated alerts and incidents: Investigate alerts, respond to breaches or policy violations, and make sure issues are resolved properly.
• Drive continuous improvement: Suggest smarter ways of working, contribute to the development of security tools and processes, and strengthen the overall security posture of the company.
• Partnering with Risk and Compliance teams: maintain and enable our compliance with frameworks such as ISO27001 and NIS2
• Lead vulnerability management: Drive system patching efforts for user endpoints and server infrastructure, making sure vulnerabilities are addressed quickly and effectively.
• Support our SOC setup: Help implement or improve tooling like SIEM and SOAR together with the other Security Analyst(s) and partners.
• Stay ahead of threats: Track what’s happening in the security world and help us stay a step ahead.
• Keep others informed: Make sure relevant updates get to the right people, and that security processes are well documented.
• Collaborate with external partners: Join conversations with groups like CSIRT-DSP and handle outside security contacts when needed.
• Work with internal teams: Server as a SME and business partner to aid other departments and product teams to improve how they handle security in their own systems and workflows.

Wat vragen wij?

• Broad security ownership experience: You bring 5+ years of experience securing enterprise environments and have owned security outcomes across identity, infrastructure, endpoints, cloud, and incident response. You have been responsible for improving security posture, not just monitoring it.
• Deep Microsoft security expertise: You have hands-on experience securing Azure, Entra ID, Conditional Access, Privileged Identity Management (PIM), Intune, and Microsoft Defender. You understand how to design and implement secure identity and access controls at scale.
• SOC/Blue Team experience: You've monitored, detected, and responded to security threats in live environments, led incident investigations, and coordinated remediation across multiple teams.
• Security tooling and detection engineering: You have experience implementing and improving SIEM, SOAR, and detection capabilities, developing use cases, tuning alerts, and increasing the effectiveness of security monitoring.
• Vulnerability management leadership: You have driven vulnerability remediation programs, partnered with infrastructure teams to prioritize risks, and ensured critical findings are resolved effectively.
• Security architecture and stakeholder influence: You are comfortable advising technical teams, challenging existing approaches, and helping shape security controls, standards, and processes across the organization.
• Reliable and flexible when needed: You’re available when something urgent comes up, even outside of regular hours.
• Netherlands-based and Hybrid-ready: You live in the Netherlands and are happy to join us on-site around two days a week.

Good to Haves

• Experience with SIEM and SOAR tooling: It’s a plus if you’ve worked with tools like Wazuh, Sentinel or Splunk and helped set them up or improve how they’re used.
• Certifications: CISSP, CISM, CompTIA Security+, CySA+, AZ-500, or SC-900 or other relevant security certifications help, but your real experience matters most.
• Familiarity with secure development practices is a bonus.

Wat bieden wij?

• Real Impact: Your work directly protects our employees, platform, our customers, and the broader internet, from handling DDOS cases to shaping how we secure our systems.
• Small Team, Big Ownership: You’re not just a cog in the machine; you’ll help shape tools, processes, and how we grow our security practice.
• Competitive Perks: Enjoy great pay, shift bonuses, annual bonus, 25 vacation days (excluding national holidays), travel allowance, and a premium-free pension.
• Skill Development: Level up with career guidance and education reimbursement.
• Gaming Perks: Get lifetime access to Ubisoft’s game library and two free games every year.
• Stay Active: Use our in-house gym in Rotterdam or unwind in the game and music rooms.