ISecurable securable = content as ISecurable;
if (securable == null)
    return;
ISecurityDescriptor securityDescriptor = securable.GetSecurityDescriptor();

var rights = securityDescriptor.GetAccessLevel(user);

Thank you, Valdis!

For the googlers and very curious listeners:
I ended up using 

IContentSecurityDescriptorExtensions.ToRawACEArray(content)

instead, because I needed to do a role check in a filter. But I got on the right track with the provided answer.

/Marten