Cyber Security Defender (SIEM & Splunk)

Global Roles; Henegouwen; Hybride; EUR 70 000 - 100 000; Plein temps

Résumé du poste

Global Roles in Belgium seeks a Cyber Security Defender to join the NATO Cyber Security Centre (NCSC) to manage and develop data security systems with a focus on SIEM and Splunk.

You will act as SME for SIEM/log collection, design distributed Splunk architectures, and support operations in line with ITIL standards. Strong Linux, scripting (Bash/Python/Ansible), and English communication are required.

Qualifications

• Bachelor’s degree or equivalent experience with 2+ years in related field.
• Extensive practical SIEM experience in large enterprise environments.
• Hands-on Splunk design and maintenance experience.
• Proven ability to analyze logs and diagnose faults.
• Strong Linux administration and scripting capabilities.

Responsabilités

• Act as SME for SIEM and log collection services.
• Provide technical advice and contribute to data security projects.
• Manage and develop data security systems.
• Support ITIL-aligned operations and service delivery across lifecycle stages.
• Ensure correct installation, configuration and operation of data security systems.

Connaissances

SIEM Administration

Splunk Enterprise

Splunk Architecture Design

Log Collection Management

System Log Analysis

Application Log Analysis

Linux OS Administration

Linux Troubleshooting

Bash Scripting

Python Scripting

Ansible Scripting

Network Security Principles

Network Security

Operating Systems Vulnerabilities

Regular Expressions

Technical Documentation Production

Cybersecurity Operations

Formation

Bachelor’s degree in related discipline

Outils

Linux

Description du poste

The Cyber Security Defender will join the NATO Cyber Security Centre (NCSC) to manage and develop data security systems, focusing on SIEM and Splunk technologies. The role involves providing technical expertise, supporting operations, and ensuring the security and proper functioning of NATO's cyber security infrastructure.

Responsibilities

• Act as one of the main engineers and Subject Matter Expert (SME) for SIEM and Log collection services.
• Provide advice and technical assistance to other stakeholders, maintain technical expertise, awareness, and developments in related new technologies, and provide technical contributions to any projects related to the data security systems.
• Responsible for management and further development of the data security systems.
• Following ITIL standards, provide support to Operations and Service Delivery management covering all stages of the data security systems lifecycle (e.g. Service Design, Transition, Operations, Change Management and Continual Service Improvement).
• Ensure that data security systems are installed, configured, and operating correctly and in line with dependencies with others systems or applications required.

Requirements

• A Bachelor’s degree at a nationally recognised/certified University in a related discipline and 2 years post-related experience. Or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate’s particular abilities or experience that is/are of interest to NCIA, that is, at least 6 years extensive and progressive expertise in duties related to the function of the post.
• At least 1 year of extensive practical experience as SIEM administrator in large enterprise environment (deployment, installation, configuration and maintenance).
• Hands-on experience in the design and maintenance of distributed Splunk architectures.
• At least 2 years and expert level experience related to SIEM and Log collection management activities with Splunk Enterprise.
• Demonstrable experience of analysing and interpreting system, security and application logs in order to diagnose faults and spot abnormal behaviours.
• Practical hands-on experience in systems and tools administration, especially Linux environment.
• Comprehensive knowledge of the principles of computer and communication security, networking, and the vulnerabilities of modern operating systems and applications.
• Practical skills in writing Bash, Python or Ansible scripts to support repetitive tasks automation.
• Solid Linux system and application administration and troubleshooting skills.
• Solid understanding of regular expressions.
• Ability to develop clear and concise technical documentation, including procedures.
• Demonstrable ability to work autonomously and proactively, to understand the chain of command and to follow internal processes.
• Good communication abilities, both written and verbal, with the ability to clearly and successfully articulate complex issues to a variety of audiences and teams.
• Fluency in English, both written and spoken.

Skills

• SIEM Administration
• Splunk Enterprise
• Splunk Architecture Design
• Log Collection Management
• System Log Analysis
• Application Log Analysis
• Linux OS Administration
• Linux Troubleshooting
• Bash Scripting
• Python Scripting
• Ansible Scripting
• Network Security Principles
• Network Security
• Operating Systems Vulnerabilities
• Regular Expressions
• Technical Documentation Production
• Cybersecurity Operations

Languages

English