PhD Position in Software Security

The faculty of Electrical Engineering, Mathematics and Computer Science (EEMCS) uses mathematics, electronics and computer technology to contribute to the development of Information and Communication Technology (ICT). With ICT present in almost every device and product we use nowadays, we embrace our role as contributors to a broad range of societal activities and as pioneers of tomorrow's digital society. As part of a tech university that aims to shape society, individuals and connections, our faculty works together intensively with industrial partners and researchers in the Netherlands and abroad, and conducts extensive research for external commissioning parties and funders. Our research has a high profile both in the Netherlands and internationally. It has been accommodated in three multidisciplinary UT research institutes: Mesa+ Institute, TechMed Centre and Digital Society Institute.

• You are a highly motivated and enthusiastic researcher, aspiring to do world-class research and have real-world impact.
• You enjoy low-level hacking and experimentation and are a good programmer, especially in C/C++.
• You have a MSc degree with excellent grades in computer science or a closely related discipline; applications from students who are about to finish their MSc degree studies will be considered as well.
• You have a solid background in systems and software security and have knowledge and skills in topics such as fuzzing, static analysis, and symbolic execution.
• You are an independent and original thinker with a creative mindset and excellent analytical and communication skills.
• You are curious and interested in learning how things work and how to make them better.
• You have great team spirit and like to work in an internationally-oriented and interdisciplinary environment.
• You are fluent in English., * A detailed Curriculum Vitae, including any publications if applicable, academic awards, links to open-source projects, and your working experience.
• A motivation letter (maximum 2 pages A4), emphasising your specific interest, qualifications, and motivation to apply for a research position in this area.
• An academic transcript of MSc education, including grades.

• Hours 40 hr.

• Salary indication Salary gross/monthly based on full-time € 3,059 - € 3,881

• Deadline 27 Mar 2026

In this PhD project, we intend to research automated techniques to analyse, exploit, and patch software vulnerabilities, after the detection phase. In fact, current tools, such as fuzzers, detect more potential flaws than organisations can fix. We plan to design and develop automated techniques to holistically analyse discovered vulnerabilities, assess their causes and risks, and prioritise the critical ones. Unlike prior work, we analyse infrastructures as a whole, instead of individual applications, allowing for prompt, effective mitigation and reducing costs.

As the prospective PhD candidate, you will be appointed for a period of four years, and you are expected to perform high-quality research that gets published at some of the top security conferences and implement open-source research prototypes that the community can benefit from. The SCS group is internationally recognized in the broad areas of systems, AI, and data security and is unique for its collaborative and friendly atmosphere, in which researchers have considerable freedom in picking their projects and receive substantial support from supervisors and colleagues. We publish in top-tier conferences to maximize our visibility and impact, and we can guide you toward becoming a top researcher and boosting your CV. Besides, during the PhD, you will have the opportunity to broaden your knowledge and network by joining international exchange programs, participating in national and international conferences, and visiting other research institutes and universities worldwide., * As a PhD candidate at UT, you will be appointed to a full-time position for four years, with a qualifier in the first year, within a very stimulating and exciting scientific environment;

• The University offers a dynamic ecosystem with enthusiastic colleagues;
• Your salary and associated conditions are in accordance with the collective labour agreement for Dutch universities (CAO-NU);
• You will receive a gross monthly salary ranging from € 3.059,- (first year) to € 3.881,- (fourth year);
• There are excellent benefits including a holiday allowance of 8% of the gross annual salary, an end-of-year bonus of 8.3%, and a solid pension scheme;
• The flexibility to work (partially) from home;
• A minimum of 232 leave hours in case of full-time employment based on a formal workweek of 38 hours. A full-time employment in practice means 40 hours a week, therefore resulting in 96 extra leave hours on an annual basis.
• Free access to sports facilities on campus
• A family-friendly institution that offers parental leave (both paid and unpaid);
• You will have a training programme as part of the Twente Graduate School where you and your supervisors will determine a plan for a suitable education and supervision;
• We encourage a high degree of responsibility and independence, while collaborating with close colleagues, researchers and other staff.

Digitalisation brings many new opportunities for businesses and governments by fostering the development of innovative online services. However, this development also brings new challenges, notably in terms of intelligence, interoperability, security and privacy. The mission of the SCS group is to realise the vision of meaningful computing within trusted digital environments by advancing the forefront of semantic modelling, enhancing cybersecurity, and innovating service design. SCS is part of the Twente University Centre for Cybersecurity Research (TUCCR), a public-private partnership where experts, professionals, entrepreneurs, researchers, and students from industry and knowledge partners collaborate to deliver talents, innovations, and know-how in the domain of cybersecurity. The mission of TUCCR is to strengthen the security and digital sovereignty of our society by performing top-level research on real-world data, systems, and network security challenges. To achieve significant societal impact, TUCCR combines technical, socio-economic, and ethical know-how and is equipped with state-of-the-art infrastructure, ranging from security labs, testbeds, and data lakes. SCS researchers play a leading role in the international cybersecurity community, regularly publishing at top security conferences such as USENIX Security, IEEE S&P, ACM CCS, and NDSS. In addition, the group is actively involved in major national and international research projects, and its work regularly finds its way into policy documents and real-world applications.