A rational security decision for a firm level should result in maximum organizational utility. Unfortunately, security managers need to constantly take decisions under uncertain circumstances and constrained budgets in order to make their organizations cyber safe. Would you like to help them determine on how and how much to invest in security? Then this position may just be the one for you!

Much of the information that we have on how companies protect themselves against cyber attacks and the costs due to successful attack events are based on estimates by experts. Since security events and losses are unevenly distributed, analysis of such estimates do not paint an accurate picture of the current situation. This PhD project focuses on designing socio-economic measurement tools and developing metrics for security variables. The aim is to measure security effectiveness based on the outcome (being compromised as an organization or not) which is in itself very hard to measure, developing metrics for effectiveness of actions, controls, or measures against the event of being hacked. This inturn will aid managers with making security investment decisions.

• We are looking for a highly motivated, entrepreneurial and enthusiastic researcher with a background in, or affinity with, researching, designing, and building dynamic modelling approaches;
• We are looking for a candidate with affinity with IT and cybersecurity;
• You have, or will shortly acquire, an MSc degree in Business Information Technology, Business Administration or comparable;
• You have a creative mindset and excellent analytical and communication skills;
• You have good team spirit and like to work in an interdisciplinary and internationally oriented environment;
• You are proficient in English.

• As a PhD student at UT, you will be appointed to a full-time position for four years, with a qualifier in the first year, within a very stimulating and exciting scientific environment;
• The University offers a dynamic ecosystem with enthusiastic colleagues;
• Your salary and associated conditions are in accordance with the collective labour agreement for Dutch universities (CAO-NU);
• You will receive a gross monthly salary ranging from € 2.541,- (first year) to € 3.247,- (fourth year);
• There are excellent benefits including a holiday allowance of 8% of the gross annual salary, an end-of-year bonus of 8.3%, and a solid pension scheme;
• A family-friendly institution that offers parental leave (both paid and unpaid);
• You will have a training programme as part of the Twente Graduate School where you and your supervisors will determine a plan for a suitable education and supervision;
• We encourage a high degree of responsibility and independence, while collaborating with close colleagues, researchers and other staff.

The Twente University Centre for Cybersecurity Research (TUCCR) is a public-private partnership where experts, professionals, entrepreneurs, researchers, and students from industry and knowledge partners collaborate to deliver talents, innovations, and know-how in the domain of cybersecurity.

The mission of TUCCR is to strengthen the security and digital sovereignty of our society by performing top-level research on real-world data and network security challenges. To achieve significant societal impact, TUCCR combines technical, socio-economic, and ethical know-how and is equipped with state-of-the-art infrastructure, ranging from security labs, testbeds, data lakes, and dedicated attack-defense environments, such as cyber ranges.

The Twente University Centre for Cybersecurity Research is a public-private partnership between the University of Twente, Cisco, SIDN, Thales, TNO, BetterBe, NDIX, NCSC, Vereniging Nederlandse Banken, SURF and Northwave.