Senior SOC Analyst

Academic Key; Netherlands; Remote; EUR 70,000 - 100,000; Full time

Job summary

Eye Security in the Netherlands seeks a Senior SOC Analyst to monitor security alerts, perform initial triage, and own escalation handling with autonomy on complex incidents.

You will coordinate with the team, produce clear documentation, and guide junior analysts, helping shape detection content and incident response improvements.

Qualifications

• 4+ years hands-on SOC/security operations experience.
• Proven ability to own and drive SLA/workload independently.
• Strong client communication in high-risk situations.
• Track record mentoring junior colleagues.

Responsibilities

• Monitor security alerts and perform initial triage; classify and close false positives.
• Take full ownership of escalated and complex alerts and perform root-cause analysis.
• Own client communication for high-risk escalations; document actions clearly.
• Independently execute containment actions and approve escalations.
• Oversee workload and SLA adherence; scale resources as needed.
• Improve documentation and working instructions; mentor juniors.
• Identify patterns indicating detection gaps and feed content owners.

Skills

SIEM

EDR

Log analysis

Incident response

Client communication

Tools

SIEM tools

EDR tooling

Cloud platforms

Job description

Senior SOC Analyst

Eye Security · Netherlands

Abroad Netherlands Full Time Link validated

Scope of Impact Actively participates with other seniors in SOC activities by providing knowledge and insight on more complex client cases. Provides ideas and concrete input for process and efficiency improvements. Actively participates in overall team- and workflow-improvement projects. Expertise In-depth knowledge of the operational use of security monitoring tools (SIEM, EDR). Ability to assess complex logs, recognise patterns, and derive actionable insights. Actively develops both technical and soft skills, and stays current with changes in the field. A credible voice and source of knowledge in the department.

Autonomy and Contribution Style Full autonomy during complex SOC escalations. Skills and confidence to coordinate the team’s response. Collaborates with, and gives guidance to, the team on arising issues. Once fully onboarded, demonstrates the ability to handle Tier 3 shifts.

Complexity High complexity: oversees entire projects and influences cross-functional teams; decisions impact the department and adjacent areas. Creates clear, structured, reproducible documentation that informs stakeholders of risks, findings, and recommended actions. Recognises higher-level security issues and resolves them independently; supports junior members in resolving theirs.

Leadership No formal leadership responsibilities. Actively coaches more junior team members to share knowledge and grow as a team.

Responsibilities Monitor security alerts and perform initial triage; classify (false positive, true positive, uncertain) and close out confirmed false positives correctly; Take full ownership of escalated and the most complex alerts: root-cause analysis, log correlation, validating assessments, determining next steps; Own client communication for assigned alerts, including difficult or high-risk escalations from more junior analysts, to a consistent quality standard; Independently execute containment actions across impact levels; approve escalations from more junior analysts; Own the team’s overall workload and service-level adherence day to day; pull in support or scale when targets are at risk; Answer cross-department questions on security operations; improve documentation and working instructions for junior levels; Mentor junior and mid-level colleagues; Identify patterns across multiple cases and escalations that point to systemic detection gaps or false-positive sources, and turn them into structured input for the detection content owners — not one-off flags; Contribute to team projects and process/efficiency improvements; Not in scope at this level, or ever, on this track. Incident response casework — a separate specialisation. Detection rule ownership, detection engineering, and threat hunting — owned by a separate team.

Requirements 4+ years hands-on SOC/security operations experience; Proven ability to own and drive the team’s SLA/workload independently; Strong client communication in high-risk situations; Track record mentoring junior colleagues; Solid log analysis and EDR platform experience; familiarity with major cloud platforms; Language fluency matching the client base supported; English internally; Dutch and/or German required or strongly preferred depending on client-facing exposure.

Growth path From here, the role forks: an individual-contributor track (Staff-level, then an optional cross-functional Principal role), or a people‑leadership track (Team Lead).

About Eye Security

Eye Security provides cybersecurity with embedded cyber insurance solutions for organisations across Europe. Headquartered in the Netherlands, 200+ FTEs and growing internationally. We combine 24/7 detection and response with hands-on incident response to keep SMEs protected.