CSIRT Analyst (Intrusion Detection and Digital Forensics) for NATO with security clearance

WLG; Henegouwen; Sur place; EUR 70 000 - 110 000; Plein temps

Résumé du poste

WLG is seeking an experienced Incident Response Lead to join our round-the-clock security team in Mons, Belgium. You will coordinate containment, eradication, and recovery activities, and support authorities, partners, and nations with security incident response.

You will drive the development of reporting, dashboards, and knowledge management while maintaining incident playbooks. Strong English, years in IR, and MITRE ATT&CK experience are required for this real-world, operational role.

Qualifications

• At least four years of hands-on incident response or adjacent fields (forensics, threat hunting, malware/ network analysis).
• Strong grasp of computer and communications security, networking, and OS/app breakpoints.
• Experience with intrusion detection and response in enterprise-scale teams, ideally MITRE ATT&CK.
• Clear familiarity with information and knowledge management in security contexts.
• Excellent written and oral communication in professional English.

Responsabilités

• Run incident response: triage, containment, eradication, recovery, including on-call.
• Provide technical coordination to authorities, partners, and organisations across nations.
• Lead or support response teams at physical locations and missions.
• Build and maintain taxonomy and portals for information management.
• Design and distribute reports, briefings, and dashboards for stakeholders.
• Maintain a live network to coordinate urgent actions.
• Identify and implement improvements to response processes with evolving threats.
• Write standard operating procedures and instructions for the program.
• Act as the response expert in meetings and incident task forces.

Connaissances

Incident response

Threat hunting

Digital forensics

Malware analysis

Network security

Security operations

Communication

English proficiency

MITRE ATT&CK

Vulnerability scoring

Formation

Bachelor's degree in related discipline

Ten years progressive expertise in this kind of work

Outils

CISM

CISSP

GIAC security qualification

Description du poste

When something gets in, somebody has to be the one who stays calm and works the problem. That is this job.

You would join the incident response team of a multinational defence organisation in Mons, Belgium, under the section head — responding to security incidents around the clock, and helping the wider alliance and its partners do the same.

What You Would Be Doing

• Running incident response — triage, containment, eradication, recovery — in normal hours and on occasional call-out
• Giving technical coordination and support to operating authorities across member and partner nations, non-governmental organisations and industry partners
• Leading or supporting response teams sent out to extend that coverage to one or several physical locations, including on operations and missions
• Building and maintaining the taxonomy behind the branch's information, and the content of the portals that sit on it
• Designing and distributing the reports, briefings and dashboards that business owners, the operational community, service management and security people each need
• Keeping a live network of security peers, so an urgent action can be coordinated when it is needed rather than when it is convenient
• Finding and implementing improvements to the response process as the threats move
• Writing the standard operating procedures and instructions that cover it all
• Acting as the response expert in meetings across the organisation and in an incident task force

What you would bring

• At least four years of hands‑on incident response, or a directly adjacent field — digital forensics, threat hunting, or malware and network analysis
• A thorough grasp of computer and communications security, networking, and where modern operating systems and applications actually break
• Recent hands‑on intrusion detection and response inside an enterprise‑scale response team, ideally against the MITRE ATT&CK framework
• At least three years in information and knowledge management, preferably in security
• Working alongside IT service management
• Very good communication and analysis, and professional English
• Vulnerability assessment and scoring — CVSS, SSVC, coordinated disclosure
• A relevant certification such as CISM, CISSP or a GIAC security qualification
• A bachelor's degree in a related discipline with three years of related experience — or, exceptionally, ten years of progressive expertise in this kind of work

Nice to have

• A degree in cyber or IT security, or information management
• Practical work or research on using AI and language models in defensive security
• Vulnerability management end to end: ingestion, scoring, prioritisation, impact
• An IT service management certification, and depth on security event sources and how to read them
• Hands‑on system and network administration, including TCP/IP engineering
• Time in a large organisational response team, and contribution to recognised communities such as FIRST

Why this one is worth a look

Very few response teams operate at this scale or with this reach, and the work is genuinely operational rather than advisory.