The Services and Cybersecurity (SCS) group at the University of Twente invites applications for a 4-year PhD position on the topic of 'evidence-based security response'.

In this PhD project, we will investigate ways to automatically collect relevant evidence of an ongoing attack in order to detect it, to assess its impact and, eventually, to decide on how to respond to it. An example of relevant evidence for an attack can be a detected anomaly in a monitored IT infrastructure. In order to decide whether the anomaly is part of an attack, we require more evidence such as whether it shows similar behavior to anomalies produced by previously seen attacks. We will research different methods (particularly based on Machine Learning) for the automated collection of relevant evidence associated with a particular attack and, based on it, for the (semi-)automated analysis of the evidence to determine the impact of the attack and to provide associated mitigation and response strategies. The offered PhD position is part of a collaborative research project with TU Eindhoven (involving a second PhD student), the Netherlands Organization for Applied Scientific Research (TNO), and the company Siemens.

The prospective PhD candidate is expected to perform high quality and internationally visible research that gets published at some of the top security conferences and journals. The candidate will be supervised by Prof. Dr. Andreas Peter and Dr. Andrea Continella from the [Services and Cybersecurity (SCS) group](https://www.utwente.nl/scs) of the University of Twente. The candidate will be appointed for a period of four years, at the end of which he/she delivers a PhD thesis. During this period, the PhD student has the opportunity to broaden his/her knowledge by joining international exchange programs, to participate in national and international conferences and workshops, to do a research internship at Siemens in Munich, and to visit other research institutes and universities worldwide.

• You are highly motivated and enthusiastic about research;
• You have a MSc degree with excellent grades in computer science, or similar; applications from students who are about to finish their MSc degree studies will be considered as well;
• You are interested in the domain of cybersecurity and particularly have a solid background in network and system security; some good background in machine learning and prior experience with writing scientific papers are of additional advantage;
• You are curious and interested in learning how things work and how to make them better;
• You are an independent and original thinker with a creative mindset;
• You have good analytical and communication skills;
• You have a good team spirit and like to work in an internationally oriented environment;
• You are proficient in English.

The offered PhD position is in the context of the SeReNity project funded by the Netherlands Organization for Scientific Research (NWO) in collaboration with the company Siemens, Netherlands Organization for Applied Scientific Research (TNO), and TU Eindhoven.

• As a PhD student at the UT, you will be appointed on a fulltime position for four years, with a qualifier in the first year, within a very stimulating scientific environment;
• The university offers a dynamic ecosystem with enthusiastic colleagues;
• Your salary and associated conditions are in accordance with the collective labor agreement for Dutch universities (CAO-NU);
• You will receive a salary ranging from around €2.434,- gross per month in the first year to around €3.111,- in the fourth year;
• There are excellent benefits including a holiday allowance of 8% of the gross annual salary, a year-end bonus of 8.3% and a solid pension scheme;
• You will have a training program as part of the Twente Graduate School in which you and your supervisors will make up a plan for additional suitable education and supervision;
• We encourage a high degree of responsibility and independence, while collaborating with close colleagues, researchers and other university staff.

Twente University Centre for Cybersecurity Research (TUCCR)
The PhD position is embedded into the [Twente University Centre for Cybersecurity Research (TUCCR)](https://www.utwente.nl/en/digital-society/research/themes/TUCCR/), which is a public-private partnership where experts, professionals, entrepreneurs, researchers, and students from industry and knowledge partners collaborate to deliver talents, innovations, and know-how in the domain of cybersecurity. The mission of TUCCR is to strengthen the security and digital sovereignty of our society by performing top-level research on real-world data and network security challenges. Key outputs include innovation in the shape of technologies, tools, minimum viable products, start-ups, top-tier scientific publications as well as first-class graduates at Bachelor, Master, and Ph.D. level. TUCCR's founding partners are Betaalvereniging Nederland, BetterBe, Cisco, NCSC, NDIX, Northwave, SIDN, SURF, Thales, TNO, and the University of Twente. TUCCR has the ambition to be a recognized thought leader in the domain of cybersecurity and to be amongst the top cybersecurity research & innovation centres in the Netherlands. It aims at having strong societal impact and at increasing the economic activity in the field of cybersecurity.