You should be able to get hold of the interface implementation from IOC container (e.g. ServiceLocator.Current.GetInstance<IContentSecurityRepository>). It is singleton scoped. A typical usage would be to have an InitializableModule (with a DependecyModule attribute to EPiServer.Web.InitiailizationModule) where you would hook up your eventhandler. The event will be raised whenever access right is changed for a content item.

Thanks Johan.  Works perfectly, example below:

[ModuleDependency(typeof(EPiServer.Web.InitializationModule))]
    [InitializableModule]
    public class SecurityEventInitializationModule : IInitializableModule
    {
        public void Initialize(InitializationEngine context)                
        {            
            var secRepos = EPiServer.ServiceLocation.ServiceLocator.Current.GetInstance<IContentSecurityRepository>();            
            secRepos.ContentSecuritySaved += secRepos_ContentSecuritySaved;
            
        }        

        public void Preload(string[] parameters) { }

        public void Uninitialize(InitializationEngine context)
        {
            var secRepos = EPiServer.ServiceLocation.ServiceLocator.Current.GetInstance<IContentSecurityRepository>();
            secRepos.ContentSecuritySaved -= secRepos_ContentSecuritySaved;
        }

        void secRepos_ContentSecuritySaved(object sender, ContentSecurityEventArg e)
        {
            //todo: implement
        }
    }