About the role
Scope of Impact
Actively participates with other seniors in SOC activities by providing knowledge and insight on more complex client cases. Provides ideas and concrete input for process and efficiency improvements. Actively participates in overall team- and workflow-improvement projects.
Expertise
In-depth knowledge of the operational use of security monitoring tools (SIEM, EDR). Ability to assess complex logs, recognise patterns, and derive actionable insights. Actively develops both technical and soft skills, and stays current with changes in the field. A credible voice and source of knowledge in the department.
Autonomy and Contribution Style
Full autonomy during complex SOC escalations. Skills and confidence to coordinate the team’s response. Collaborates with, and gives guidance to, the team on arising issues. Once fully onboarded, demonstrates the ability to handle Tier 3 shifts.
Complexity
High complexity: oversees entire projects and influences cross-functional teams; decisions impact the department and adjacent areas. Creates clear, structured, reproducible documentation that informs stakeholders of risks, findings, and recommended actions. Recognises higher-level security issues and resolves them independently; supports junior members in resolving theirs.
Leadership
No formal leadership responsibilities. Actively coaches more junior team members to share knowledge and grow as a team.
Responsibilities
- Monitor security alerts and perform initial triage; classify (false positive, true positive, uncertain) and close out confirmed false positives correctly
- Take full ownership of escalated and the most complex alerts: root-cause analysis, log correlation, validating assessments, determining next steps
- Own client communication for assigned alerts, including difficult or high-risk escalations from more junior analysts, to a consistent quality standard
- Independently execute containment actions across impact levels; approve escalations from more junior analysts
- Own the team’s overall workload and service-level adherence day to day; pull in support or escalate when targets are at risk
- Answer cross-department questions on security operations; improve documentation and working instructions for junior levels
- Mentor junior and mid-level colleagues
- Identify patterns across multiple cases and escalations that point to systemic detection gaps or false-positive sources, and turn them into structured input for the detection content owners — not one-off flags
- Contribute to team projects and process/efficiency improvements
Not in scope at this level, or ever, on this track
- Incident response casework — a separate specialisation
- Detection rule ownership, detection engineering, and threat hunting — owned by a separate team
Requirements
- 4+ years hands-on SOC/security operations experience
- Proven ability to own and drive the team’s SLA/workload independently
- Strong client communication in high-risk situations
- Track record mentoring junior colleagues
- Solid log analysis and EDR platform experience; familiarity with major cloud platforms
- Language fluency matching the client base supported; English internally; Dutch and/or German required or strongly preferred depending on client-facing exposure
Growth path
From here, the role forks: an individual-contributor track (Staff-level, then an optional cross-functional Principal role), or a people-leadership track (Team Lead).
About Eye Security
Eye Security provides cybersecurity with embedded cyber insurance solutions for organisations across Europe. Headquartered in the Netherlands, 200+ FTEs and growing internationally. We combine 24/7 detection and response with hands-on incident response to keep SMEs protected.