Content Engineer CSOC (Dutch speaking)

Job description Want to make sure cyber threats are recognized before they cause impact? As a Content Engineer CSOC at KPN, you translate current threats and attack techniques into smart detections. You build, test and improve security content, directly contributing to the digital safety of the Netherlands. As a Content Engineer CSOC, you ensure that relevant threats are detected in a timely and effective manner within KPN's security monitoring services. You translate threats, attack techniques and customer needs into concrete detection use cases and technical security content. In this way, you form the substantive link between threat intelligence, SOC operations, security technology and the customer's environment. As a Content Engineer, you are responsible for developing, implementing and continuously improving the content with which the SOC detects deviant and malicious behavior. You develop detection rules and use cases, ensure that the required logging and data sources are well utilized, and verify whether detections actually do what they are intended to do. You translate new threats, TTPs and insights from incidents into improvements in detection. In doing so, you look not only at new content: you also monitor the quality of existing detections and ensure that they remain relevant, effective and manageable. Are you ready to take the next step in your career and contribute to the digital safety of the Netherlands? With us, you connect not only people but also systems, processes and data. As a System Integrator, we ensure that all technological components work together seamlessly. In this way, we help organizations stay one step ahead in a world that is digitalizing at lightning speed. Your most important responsibilities: - Detection engineering and use cases: You design, build, test and maintain detection use cases and correlation rules for security monitoring. You translate concrete attack scenarios into detection logic so that the SOC can recognize relevant threats in a timely manner. - Threat intelligence and MITRE ATT&CK: You translate current threat information, TTPs and attack patterns into new and improved detections, and use MITRE ATT&CK to make the coverage of monitoring transparent. - Quality and optimization: You analyze the functioning of existing security content and improve it based on experiences from monitoring, incidents and threat hunting. In doing so, you look for the right balance between detection quality and usability for the SOC. - Validation and scenarios: You develop and use attack scenarios and adversary simulations to test whether detections work in practice. You collaborate with SOC, blue, red and purple team specialists and translate the results into concrete improvements. - Further development and automation: You contribute to further automation of security monitoring and explore how new technology, including AI and LLMs, can be applied for analysis, triage and improvement of security content. - Collaboration and lifecycle: You work together with SOC analysts, engineers and other security specialists to bring new content into production in a controlled manner and to keep existing content up to date and effective throughout its full lifecycle. Job requirements You are a technically strong security specialist who thinks from the perspective of both the attacker and the defender. You understand how a SOC works and can translate complex attack techniques into concrete and maintainable detections. You combine analytical ability with a practical engineering mindset: you not only think about what should be detected, but also build, test and improve it. You work in a structured way and actively seek collaboration with SOC analysts, engineers and other security specialists. In addition, you have: - HBO/WO working and thinking level and relevant experience in security monitoring, SOC, detection engineering or a comparable technical security environment. - In-depth knowledge of SOC processes, including detection, triage, analysis and incident response. - Experience with SIEM/SOAR technology, log analysis, correlation and developing detection rules and security use cases. - Knowledge of MITRE ATT&CK, threat hunting, TTPs and adversary simulation. - Experience with scripting, APIs or automation within security is a plus. - Affinity with AI/LLM applications for security monitoring, analysis and automation is a plus. - Good command of the Dutch language. An AIVD screening is a mandatory part of the application procedure.