Security Operations Center Analyst

SOC Analyst — Den Haag

40 hours · 24/7 shifts · employment with BrightStone Group

€ 4.100 gross per month including holiday allowance, plus shift allowance for the rota

A dedicated Security Operations Centre inside an international institution in Den Haag. One client, one team, on-site, around the clock. You would join the rota that keeps it running.

The work itself is monitoring, triage and analysis of security events, and first response when something turns out to be real. Splunk is the platform. Between alerts you write up what happened and answer questions from people across the organisation — and you help make the detections better than they were last month. Detection engineering, threat hunting, vulnerability management, threat intelligence. How much of that you take on is mostly up to you.

One position. The bar on paper is low: a year on shift in a SOC. The bar in practice is a different question, and it has nothing to do with your CV.

What you need

• A year or more as a SOC analyst, actually working shifts. A day job with occasional on-call is not the same thing and the client will spot the difference
• Splunk, or a SIEM you know well enough to move across from — Sentinel, QRadar, Elastic, ArcSight
• Good English, written and spoken. Dutch is not required here and you will barely use it
• EU nationality and ten years of history you can document, because you will be screened to EU Secret level

Helpful, none of it required: BTL1 or BTL2, GCIH, GSOM, CySA+, CISSP. Writing your own SPL rather than running someone else's. Sigma rules. Any time spent in a defence or NATO environment.

The parts most ads leave out

• Rotating 24/7 shifts. Nights, weekends, and whichever holiday falls on your week. If you have never worked a rota, speak to someone who has before you reply to this
• On-site in Den Haag, every shift. No hybrid days. The environment does not permit it
• Screening runs to roughly three months and you cannot start until it clears. If you already hold EU Secret, NATO Secret or a current Dutch AIVD clearance, lead with that in your first message. It changes your entire timeline and it is the first thing I will ask
• Employment with BrightStone Group. No ZZP, no doorleen construction
• The assignment runs to 31 October 2027, with an option to extend

One thing worth saying about the screening. A clearance takes three months, costs you nothing, and stays with you afterwards. There is a small group of people in this country who can walk into work like this, and the only reason the group is small is that most people never start the process.

Applying

The request closes on Monday 24 August at 12:00, so I need your CV by Friday evening at the latest. Message me here or call. If you are unsure whether the shift pattern is something you can live with, call anyway — that conversation takes five minutes and it is better had now than in November.