Security Operations Engineer

Security Operations is Exact's security engineering team, owning two areas: security across Exact's full product portfolio, and the development of Identity and Access Management (IAM) functionality used across Exact's products. The team builds secure tooling that integrates into engineering teams' existing workflows, bringing a security-first mindset into the development lifecycle (SSDLC). Automation covers what it can; manual, pen test-style testing covers what it can't. This = the job that you aspire to Within the team, you write code across several fronts: owning key parts of the secure tooling and playbooks that help secure-by-default practices scale across Exact's full portfolio, resolving the most complex low-level security issues, and contributing to the development of Identity and Access Management (IAM) functionality. As this scope grows, you also help grow the skills and capability of the team around you. - You own key parts of the team's shift-left security tooling and playbooks. - You resolve the most complex low-level security issues and build tools that prevent insecure software patterns. - You help run and improve the team's recurring scanning and testing program, guiding engineering teams toward fixes. - You lead structured security campaigns end to end: defining scope, ranking findings by risk, investigating the highest-risk areas in depth, and reporting clearly on what was tested, what was found, and what remains open. - You coach and mentor colleagues, and support threat modeling and attack-surface analysis across the team. This = your team Security Operations is part of Technology, made up of security-minded software engineers who both build and break things: building secure tooling and IAM functionality, and testing systems the way an attacker would to see if they hold up. The team continuously refines its tooling, playbooks, and methods based on what it finds. This = what you bring - A solid software engineering background (roughly 5+ years), you've built and shipped production code, ideally in C#/.NET or a comparable ecosystem, and you understand how real systems are designed and where they break. - In-depth, hands-on security expertise and classical penetration-testing skill: you can manually probe authentication/authorization flaws, IDOR, SSRF, injection, business-logic abuse, and client-controlled trust boundary issues, not just read a scanner report. - Practical experience with threat modeling (e.g., STRIDE, PASTA, or an equivalent structured approach) and attack-surface analysis, and the confidence to challenge and be challenged on it with architects and peers. - Demonstrated ability to coach, train, or mentor other engineers, through pairing, code/finding review, or structured knowledge transfer. - Strong communication skills: you can write a clear, evidence-backed finding, explain risk to non-technical stakeholders, and defend a technical judgment call under scrutiny. - Comfort operating with ambiguity, in a security practice that continually adapts its methods to a fast-changing and expanding product portfolio. Nice to have (not required, but a strong plus given the depth this role needs): - OSCP (Offensive Security Certified Professional) or OSWE/GWAPT: recognized, hands-on penetration-testing certifications. - CSSLP (ISC2): secure software lifecycle, a strong fit given the software-engineering-plus-security blend and the coaching angle of this role. - CISSP or equivalent broader security-governance certification (optional plus, not core for this hands-on role). - Experience with CVSS scoring, structured vulnerability reporting, or bug bounty/pentest work. This = our tech stack Exact's core products are primarily built in C#/.NET (with some legacy VB). Across the wider Exact portfolio you will also encounter other languages, such as C, Python, and PHP; you should be comfortable reading and reasoning about unfamiliar codebases and architectures, not just your own stack. The team relies on a combination of automated scanning and dependency tooling, AI-assisted analysis, and manual, pentest-style testing with tools such as Burp Suite or OWASP ZAP. This = what you get - At Exact, we understand the importance of achieving a healthy balance between effort and relaxation, because it enhances both job satisfaction and well-being. - Over 2,000 colleagues worldwide, with technology colleagues across our offices in Delft (HQ), Utrecht, Eindhoven, Zwolle, and our Kuala Lumpur development center. - A 40-hour workweek on a permanent (indefinite) contract. - Hybrid working model: 2 days in the office, 3 days working from home. - Competitive salary, a thirteenth month, and 8% holiday allowance. - A modern pension scheme. - 27 vacation days, plus up to 5 loyalty days (one extra day per full year of employment) and up to 3 "Giving Back" days for a charity of your choice. - Home office supplies to support your home working setup. - Access to LinkedIn Learning and Exact's own learning & development center to help you grow into this role. - Events such as a global hackathon and Tech Talks to develop and showcase your skills. About Exact Exact develops cloud software for small and medium-sized companies and their accountants. The products automate business processes in areas such as Finance and HR and provide specific ERP solutions for wholesale distribution, manufacturing, projects and construction. This saves time and provides insight. It enables customers to work efficiently, make informed decisions and continue growing. More than 675,000 companies primarily in the Netherlands, Belgium and Germany already rely on Exact's software. Exact was founded in 1984 in Delft, the Netherlands, which is still the location of our head office. Every day, more than 2,000 ambitious professionals work on innovation. Driving responsible business, with respect for each other, the environment and society is central to this. For more information, visit www.exact.com. Ready to Join Us? We're excited to hear from you. After you apply, one of our Talent Acquisition Specialists will contact you to answer any questions and discuss your experience and ambitions. The selection process typically includes: - An introductory conversation. - A coding challenge. - A technical and team interview. - Offer stage - If there's a match on both sides, we'll be delighted to welcome you to the Security Operations team.