Neotalent Conclusion is one of the leading Iberian specialists in Information Technology and Engineering Talent acquisition and management. As part of the Dutch Conclusion group, an ecosystem of 25 companies and 3,600 employees, we focus on increasing our clients' technological capabilities and accelerating their digital transformation.
At Neotalent Conclusion , we are talent specialists. We attract the best professionals and combine them with the most ambitious projects at the right time. Our success is built on investment in innovation, a results-driven mindset, and above all, ensuring that people have fulfilling and rewarding careers.
With more than 25 years of experience, Neotalent Conclusion has offices in Madrid, Lisbon, and Porto. Our company is made up of a team of more than 850 professionals across different areas of operation.
Neotalent, the responsive people.
More information at and
We are looking for a Purple Team Specialist to join our teams and work with a leading integral insurance company in an international cybersecurity environment.
What will your responsibilities be? Plan and execute threat-led security validation exercises based on threat intelligence, recent incidents, business risks, and detection gaps.
Design and perform adversary emulation campaigns and atomic testing activities across endpoint, identity, email, network, and cloud environments.
Map attack activities to the MITRE ATT&CK; framework and assess security control effectiveness.
Partner with Detection Engineering and Threat Hunting teams to validate telemetry and improve detection coverage.
Create, tune, and optimize analytics, correlation rules, and behavioral detections.
Validate and improve KQL queries, reducing blind spots and false negatives.




Assess end-to-end SOC readiness, including alert generation, enrichment, triage, escalation, investigation, containment, and documentation processes.
Evaluate technical controls, operational procedures, and automated response playbooks.
Produce root cause analyses, remediation recommendations, and re-testing activities until objectives are achieved.
Develop automation assets, reusable testing content, integrations, and reporting mechanisms using Python, PowerShell, Bash, APIs, and CI/CD pipelines.
Maintain ATT&CK-aligned; coverage metrics and reporting on detection performance and remediation progress.
Facilitate purple team workshops, after-action reviews, and knowledge-sharing sessions with SOC stakeholders.
What profile are we looking for? University degree in Information Security, Computer Science, Engineering, or an equivalent combination of education and professional experience.
Between 3 and 7 years of professional experience in cybersecurity environments.
At least 3 years of hands-on experience in offensive security, adversary emulation, penetration testing, detection engineering, threat hunting, incident response, or related disciplines.
At least 3 years of practical Red Team and/or Purple Team experience in enterprise environments.
Strong expertise in Detection Engineering (mandatory and key requirement).




Proven experience transforming test results into improved detections, telemetry, investigation processes, response playbooks, and remediation actions.
Deep understanding of MITRE ATT&CK; and threat-informed defense methodologies.
Experience with enterprise SOC technologies, including SIEM, EDR/XDR, SOAR, network security monitoring, email security, identity telemetry, and cloud security logging solutions.
Strong expertise with Microsoft Sentinel.
Strong expertise with Microsoft Defender XDR.
Hands-on experience writing and optimizing Kusto Query Language (KQL) queries.
Knowledge of Windows, Linux, Active Directory, Microsoft Entra ID, Microsoft 365, cloud, and network attack paths and post-exploitation techniques.
Experience developing automation using Python, PowerShell, Bash, APIs, version control systems, and CI/CD environments.
Excellent English communication skills. Spanish is a plus.
Nice to have: Experience working in highly regulated or multinational enterprise environments.
Experience supporting large-scale Security Operations Centers.
Knowledge of cloud security architectures and modern detection engineering practices.
Required Certifications (mandatory) Candidates must hold one or more of the following certifications:
OSCP (Offensive Security Certified Professional)
CRTO (Certified Red Team Operator)
CRTP (Certified Red Team Professional)
GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)
GCFA (GIAC Certified Forensic Analyst)
SC-200 (Microsoft Security Operations Analyst)
AZ-500 (Microsoft Azure Security Engineer Associate)
Microsoft Sentinel Certifications
Work as a Neotalent Conclusion employee in an exclusive partnership with our clien

📌 Community Specialist (España)
🏢 Neotalent Conclusion
📍 España