Content Engineer CSOC (Dutch speaking)

• A gross monthly salary of at least €5,216 and a maximum of €7,843, depending on your work experience, based on 40 hours

• Fixed 13th month, part of which you receive monthly and part in January of the following year. Or, you can put it towards a FLEX & BOOST goal of your choice! Click here to read more about it

• Annual individual and collective increases in accordance with our CAO

• € 1,500 per year in availability budget that you may use at your own discretion for, for example, training, coaching, and courses

• Flexible days off: our colleagues may decide for themselves (in consultation with the manager) how they manage their leave

• A good work-life balance (such as 2 days in the office, 3 days at home, transition leave, exchanging a public holiday for a holiday of your religious or cultural preference)

• Home office workshop to optimally set up your workspace at home, including a mobile phone & laptop, of course

• 50% discount on our products and services, so you can enjoy internet, calling, and streaming at a discount

• Good travel allowance: you receive full reimbursement for your public transport costs or € 0.23 per kilometer if you travel by car. Prefer to come by bike? Then you can claim our bicycle allowance of € 0.40 per kilometer

• Possibility to purchase a lease bike that KPN contributes to monthly (with an indefinite contract): From city bikes to e-bikes and from racing bikes to speed pedelecs; you choose what you ride

• Excellent pension conditions: a total contribution of 25% of your pensionable salary, of which KPN contributes 17.5% and you 7.5%

Are you ready to take the next step in your career and do you want to contribute to the digital security of the Netherlands? With us, you connect not only people, but also systems, processes, and data. As a System Integrator, we ensure that all technological components work together seamlessly. This is how we help organizations stay one step ahead in a world that is digitizing at lightning speed.

As a Content Engineer CSOC , you ensure that relevant threats are detected in a timely and effective manner within KPN's security monitoring services. You translate threats, attack techniques, and customer needs into concrete detection use cases and technical security content. In doing so, you form the substantive link between threat intelligence, SOC operations, security technology, and the customer's environment.

As a Content Engineer, you are responsible for developing, implementing, and continuously improving the content used by the SOC to detect anomalous and malicious behavior. You develop detection rules and use cases, ensure that the necessary logging and data sources are utilized effectively, and test whether detections actually do what they are intended to do. You translate new threats, TTPs, and insights from incidents into improvements in detection. In this process, you do not only look at new content: you also monitor the quality of existing detections and ensure they remain relevant, effective, and manageable.

1. Detection engineering and use cases: You design, build, test, and maintain detection use cases and correlation rules for security monitoring. You translate concrete attack scenarios into detection logic that enables the SOC to recognize relevant threats in a timely manner.

2. Threat intelligence and MITRE ATT&CK: You translate current threat information, TTPs, and attack patterns into new and improved detections and use MITRE ATT&CK to make the monitoring coverage transparent.

3. Quality and optimization: You analyze the performance of existing security content and improve it based on experiences from monitoring, incidents, and threat hunting. In doing so, you seek the right balance between detection quality and usability for the SOC.

4. Validation and scenarios: You develop and use attack scenarios and adversary simulations to test whether detections work in practice. In doing so, you collaborate with SOC, blue, red, and purple team specialists and translate the results into concrete improvements.

5. Further development and automation: You contribute to the further automation of security monitoring and investigate how new technology, including AI and LLMs, can be applied for analysis, triage, and the improvement of security content.

6. Collaboration and lifecycle: You work together with SOC analysts, engineers, and other security specialists to bring new content into production in a controlled manner and to keep existing content current and effective throughout its entire lifecycle.

You are a technically strong security specialist who thinks from the perspective of both the attacker and the defender. You understand how a SOC works and can translate complex attack techniques into concrete and maintainable detections. You combine analytical ability with a practical engineering mindset: you not only devise what needs to be detected, but you also build, test, and improve it. You work in a structured manner and actively seek collaboration with SOC analysts, engineers, and other security specialists.

Of course, as an employer, we also have a lot to offer you. This is what you get from us:

Our belief in technology is great. This becomes even more powerful together with human contact, which is why we would love to meet you!

Want to know more? Contact our recruiter Szilvia Haraszti via szilvia.haraszti@kpn.com. Applications sent by email cannot be processed. Please indicate your interest via the application button.

At KPN, we have recruitment talent that works together smartly and thus wins. Therefore, acquisition in response to this vacancy is not appreciated.