Flexport believes global trade can move the human race forward. The mission is to make global commerce so easy there will be more of it.
Companies of all sizes use Flexport technology to move more than $19B of merchandise across 112 countries a year.
Responsibilities
Build and tune detections across endpoint, identity, SaaS, and cloud, treating them as software: version-controlled, peer-reviewed, and shipped through CI/CD practices.
Track detection quality as measured quantities: coverage against MITRE ATT&CK, precision, time-to-detect.
Own EMEA-hours incident response: triage, contain, remediate, and write the retrospective that turns the incident into a systemic fix.
Build automation that removes toil from investigations, and partner closely with the US-based team.
Define telemetry requirements for new systems before they ship, working with infrastructure and product teams.
Threat hunt proactively across the estate, converting hypotheses into new detections or documented coverage.
Requirements
Typically 5–8 years of experience in detection engineering, incident response, or threat hunting, with real hands-on time writing and tuning detections.
Proficiency in at least one programming language (Python, Go, or similar) and comfort writing production-grade detection and automation code.
Experience with a modern SIEM or detection pipeline (Panther, Elastic, Splunk, or similar).
Practical incident response experience: led or played a major role in triaging and closing out real security incidents.
Nice to Have
Experience treating detections as code with CI/CD, peer review, and staged rollout.
Experience defining telemetry contracts for systems before they ship.
A track record of critically evaluating and verifying AI-assisted work.
Familiarity with EU data-residency and cross-border data-handling considerations.
Experience with fraud or financial-crime detection patterns.
Conditions
In Amsterdam, come to the office 3 times a week.
Stay closely aligned with coworkers on other continents.
Latest hardware and software, including frontier AI models on day one.
Agile, but not dogmatic.
Visa sponsorship for the right candidate.
Daily catered lunches, breakfast, snacks and soft drinks.
Commute expenses covered for employees living outside of Amsterdam.