Building a SOC, and then leaving it with your own people.
After an incident, an insurer requirement or a NIS2 obligation, the organisation wants to see for itself what's happening in the network and respond to it. That means logging that's right, a SIEM or detection platform that's configured, use cases that catch real attacks, and people who know what to do with an alert. Within two days you'll have an experienced SOC lead or detection engineer interviewed who builds that and, this being the point, leaves it with your own team. If you need someone permanently, we recruit that person just as well, though not within two days.
The moment
The trigger varies, the question doesn't. An incident where it turned out afterwards that the attacker had been inside for weeks and nobody saw it. An insurer or a major customer asking about detection and response. The Dutch Cybersecurity Act requiring a working reporting procedure, and therefore something to report with. Or a SIEM bought five years ago that still only collects logs and now has to be replaced by a platform that actually does something. In all cases the organisation wants to see for itself what's happening and respond, with its own people, without being dependent on an external party forever. And then it turns out nobody in-house has built this before.
What goes into a SOC that works
A SOC is not a tool and not a room with screens. It's logging from the right sources (identity, endpoints, network, cloud), a platform that understands those logs, use cases that catch the attacks that fit your organisation instead of a thousand default alerts, playbooks for what happens on an alert, and analysts who know those playbooks. Those who start small, with a handful of detections that matter and a process that is actually followed, have something that works within months; those who start big have within months a platform full of noise and a team that dismisses alerts. An interim SOC lead who has built this before chooses the small route and trains your own people in the meantime, so the SOC belongs to them after the project.
What needs to happen now
- Goal and scope. What the SOC must be able to see, how fast to respond, and for which systems first. The SOC lead with management and IT, in the first weeks.
- Logging and platform. Connecting the right sources, configuring or migrating the SIEM or detection platform, keeping retention and costs under control. SIEM or detection engineer.
- Use cases that matter. Detections for the attack paths that fit you, tested against real scenarios, with as little noise as possible. Detection engineer.
- Playbooks and rehearsal. What an analyst does on which alert, who gets called when, how the regulator or customer is notified. SOC lead, rehearsed with the team.
- Handover to your own team. Analysts trained, documentation complete, and an agreement on how detections are maintained. That's the assignment; without this part you've bought a new dependency.
Who leads this
Organisations here look for a SOC lead or SOC manager who builds it and takes the team along, a detection engineer for the use cases, a SIEM engineer for the platform and the migration, and afterwards analysts who keep it running. Which of those roles it is for you depends on what's already in place and whether you already have the analysts; that's where the intake starts. The analysts and the SOC lead who stays are often permanent roles: permanent recruitment; the build is interim. We've been doing both for years, and here we prefer to do them in one move.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: which trigger, which tooling is in place, who are the people who will have to do it. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
Building and handing over a SOC is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. The analysts who handle alerts daily afterwards and the SOC lead who stays are jobs. Then we'll say so. Usually those are permanent roles through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
How fast can you provide a SOC lead or detection engineer?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about the trigger, the tooling in place and the people who will have to do it, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
Isn't our own SOC too expensive for an organisation of our size?
That depends on what you mean by it. A room with screens and 24/7 staffing is overkill for most organisations; a small team covering office hours with a limited set of detections that matter, and an arrangement with an external party for the night, is often exactly right. A SOC lead who has built this before says honestly what fits your size.
Can you also do a SIEM migration?
Yes. Many organisations replace an old SIEM that only collects logs with a platform that also detects. A SIEM engineer migrates sources and use cases, keeps costs under control and makes sure there's no gap during the transition. Tell us at the intake from and to which platform, and we'll propose people who have demonstrably worked with them.
Freelance, secondment or permanent: what suits building a SOC?
The build and the handover are an assignment with a clear beginning and end, and then a freelancer with a model agreement fits well. The analysts who handle alerts daily afterwards and the SOC lead who stays are jobs; then we'll say so and recruit them permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does an interim SOC lead cost?
That depends on the person and the assignment, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment. The rate bands of who is currently available are listed anonymously with the interim professionals on this site.
How do you make sure the SOC really belongs to our team after the project?
By making the handover part of the assignment: analysts who participate from the first use case, documentation and playbooks that are complete, and an agreement on who maintains the detections. A SOC only the interim professional understands is a new dependency, and that's exactly what you didn't want to buy.
We don't have analysts yet. Can you find those too?
Yes, and preferably in parallel with the build, so they participate from the start and the interim professional can train them. Recruiting SOC analysts is what we've been doing for years; the interim SOC lead can help assess the candidates on substance.
Does a SOC also help with NIS2 and the Dutch Cybersecurity Act?
Yes. The reporting obligation requires incidents to be reported within 24 hours, and that's only possible if you see them. Detection and a rehearsed reporting process are therefore a direct fulfilment of the duty of care. If your organisation falls under the Act, also see our page on NIS2 and the Dutch Cybersecurity Act.
Want your own detection, nobody to build it?
Tell us what's already in place in logging and tooling and what the SOC should be able to do. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.