Actively participates with other seniors in SOC activities by providing knowledge and insight on more complex client cases. Provides ideas and concrete input for process and efficiency improvements. Actively participates in overall team- and workflow-improvement projects.
In-depth knowledge of the operational use of security monitoring tools (SIEM, EDR). Ability to assess complex logs, recognise patterns, and derive actionable insights. Actively develops both technical and soft skills, and stays current with changes in the field. A credible voice and source of knowledge in the department.
Full autonomy during complex SOC escalations. Skills and confidence to coordinate the team’s response. Collaborates with, and gives guidance to, the team on arising issues. Once fully onboarded, demonstrates the ability to handle Tier 3 shifts.
High complexity: oversees entire projects and influences cross-functional teams; decisions impact the department and adjacent areas. Creates clear, structured, reproducible documentation that informs stakeholders of risks, findings, and recommended actions. Recognises higher-level security issues and resolves them independently; supports junior members in resolving theirs.
No formal leadership responsibilities. Actively coaches more junior team members to share knowledge and grow as a team.
Monitor security alerts and perform initial triage; classify (false positive, true positive, uncertain) and close out confirmed false positives correctly
Take full ownership of escalated and the most complex alerts: root-cause analysis, log correlation, validating assessments, determining next steps
Own client communication for assigned alerts, including difficult or high-risk escalations from more junior analysts, to a consistent quality standard
Independently execute containment actions across impact levels; approve escalations from more junior analysts
Own the team’s overall workload and service-level adherence day to day; pull in support or escalate when targets are at risk
Answer cross-department questions on security operations; improve documentation and working instructions for junior levels
Mentor junior and mid-level colleagues
Identify patterns across multiple cases and escalations that point to systemic detection gaps or false-positive sources, and turn them into structured input for the detection content owners — not one-off flags
Contribute to team projects and process/efficiency improvements
Incident response casework — a separate specialisation
Detection rule ownership, detection engineering, and threat hunting — owned by a separate team
4+ years hands-on SOC/security operations experience
Proven ability to own and drive the team’s SLA/workload independently
Strong client communication in high-risk situations
Track record mentoring junior colleagues
Solid log analysis and EDR platform experience; familiarity with major cloud platforms
Language fluency matching the client base supported; English internally; Dutch and/or German required or strongly preferred depending on client-facing exposure
From here, the role forks: an individual-contributor track (Staff-level, then an optional cross-functional Principal role), or a people-leadership track (Team Lead).
Eye Security provides cybersecurity with embedded cyber insurance solutions for organisations across Europe. Headquartered in the Netherlands, 200+ FTEs and growing internationally. We combine 24/7 detection and response with hands-on incident response to keep SMEs protected.