Security Analist

Would you like to help keep the services SURF provides to its members secure against cyber threats? Do you enjoy identifying potential cyber threats both reactively and proactively and taking action to address them? Are you interested in continuously improving and further developing all the infrastructure and tools needed for this, together with your immediate colleagues and service managers? If so, the SURF SecOps team could really use your help!

Where you will work

SURF is the ICT cooperative for Dutch educational and research institutions. Together with them, we work on digital services and complex innovation challenges to enhance the quality of education and research.

Working at SURF means working for a unique and open organization. This is evident in everything: the structure of the organization, the setup of the project teams, the culture in our offices, and the atmosphere among colleagues. SURF offers excellent terms of employment and a flexible approach to work/life balance. Employees enjoy working independently. In addition, everyone is given the space and freedom to use and develop their talents as effectively and broadly as possible.

The team you will join

You’ll be joining SecOps, a small, specialized, and driven subteam within the Security Engineering team. This team possesses a wealth of knowledge and experience in the field of cybersecurity, both in breadth and depth. While the broader team focuses on providing technical security services to institutions affiliated with SURF such as certificate issuance, VPN, and domain management SecOps focuses specifically on SURF’s internal security.

SecOps is responsible for the technical support and implementation of security policies within SURF’s internal organization. The team handles various aspects of information security, including consulting, prevention, detection, and resolution of security issues.

This includes advising on security issues, managing operational security standards, and conducting analyses. In addition, the team detects threats using SIEM, IDS/IPS, and central logging; supports vulnerability management and penetration testing; and resolves security incidents. Handling Coordinated Vulnerability Disclosures (CVD) is also part of the role.

You will work alongside colleagues who possess a wide range of security expertise and who are dedicated to ensuring SURF’s digital security every day.

What you will do

As a Security Analyst, you are responsible for monitoring, detecting, investigating, and following up on security threats and incidents within SURF, ranging from workstations to supercomputers and the cloud.

You analyze security alerts and contribute to the effective handling of incidents, from initial triage to complex incident investigations. In doing so, you serve as a pillar of support during incidents for colleagues within SURF who manage services.

You are part of the Security Incident Response Team (SIRT) and participate in the 24/7 on-call rotation.

In addition, you’ll actively work to improve our detection capabilities by, for example, developing detection rules, conducting threat hunting, and researching and reproducing new attack techniques and exploits. You’ll collaborate on this with both your immediate SecOps colleagues and colleagues from SURFsoc and SURFcert, who perform these tasks for our external audience. This is how we strengthen each other.

In addition to your operational SOC work, you’ll be responsible for gaining in-depth expertise in one or more technical areas of focus, such as vulnerability management, threat intelligence, or Elasticsearch engineering.

Other responsibilities include

• Advising and supporting service administrators on connecting to and making the best possible use of SecOps services and support.
• Developing, testing, improving, and maintaining detection rules in Elastic Security and Microsoft Sentinel.
• Developing and improving SOAR playbooks, automations, investigation procedures, and runbooks.
• Contributing to the continued professionalization of the SOC.

Your skills and experience

You are a cybersecurity professional with a solid technical foundation and the ability to clearly explain security issues to a variety of audiences. You combine subject-matter expertise with strong communication skills and an understanding of diverse interests. You enjoy working collaboratively but can also act independently when the situation calls for it.

In addition, you have

• A college or university level of education and thinking, with 3–5 years of relevant work experience;
• Demonstrable experience with security monitoring and incident investigation and resolution;
• Knowledge of attack techniques and relevant frameworks such as MITRE ATT&CK;
• Willingness to participate in on-call duties and incident response outside regular working hours;
• Strong communication skills in Dutch and English;
• Strong analytical skills and the perseverance to independently investigate complex issues.
• Thorough knowledge of operating systems (particularly Linux) and networks.

Prior to starting this job, a VOG must be presented.

SURF takes pleasure in doing its recruitment itself; acquisition is therefore not appreciated.