CYBERSPACE OPERATIONS GENERATIVE ARTIFICIAL

Brevco Services; Henegouwen; Hybride; EUR 90 000 - 115 000; Plein temps

Résumé du poste

NCIA is seeking a highly skilled professional to design and sustain an on-prem AI server capability within secure environments. You will map current architecture, tooling, and security controls, and coordinate workshops with SOC/DFIR/Threat Hunting to validate the as-is workflow.

The role requires Linux administration, AI platform hosting, data governance, and strong knowledge of Confluence documentation and SOPs.

Qualifications

• 3+ years as a Red Hat Linux admin in on-prem environments.
• 1+ years building/operating AI/ML platforms on-prem (GPU servers, CUDA, containers, model serving).
• 2+ years integrating AD/LDAP/SAML/OIDC with RBAC and least privilege.
• Experience delivering AI-enabled cyber security use cases (SOC/Threat Hunting/IR/DFIR/Malware Analysis).
• Experience implementing RAG in prod-like environments with grounding/citations and evaluation methods.
• Governing multiple data sources (SIEM/SOAR, EDR, case mgmt, knowledge bases, file shares) with access controls.
• Security logging/auditability for AI systems (logs, model usage telemetry).
• Producing/maintaining Confluence SOPs/SOIs and runbooks (min 2 years).
• Knowledge of OSI layers & TLS.
• Strong containerization (Docker/Podman) incl. GPU scheduling.
• Model serving patterns (vLLM/TGI/llama.cpp runtimes, API gateways)
• LLM security risks & mitigations; secure prompt/data handling.
• CIA risk analysis for toolsets/data flows and mitigations.
• Certifications (CISSP/CISM/CCSP); RHCSA/RHCE or equivalents.

Responsabilités

• Capture the current state of the on-prem AI server capability and supporting processes.
• Document architecture, deployment (hardware, virtualization/containers, GPU stack, storage, networking, backups, patching).
• Identify current AI toolset, security controls, data sources, logging/monitoring, and documentation gaps.
• Organize up to 3 workshops with SOC/DFIR/Threat Hunting/IR admins to validate workflows.

Connaissances

Red Hat Linux admin

AI/ML platforms on-prem

Enterprise auth integration

AI-enabled cyber security use cases

Retrieval-Augmented Generation (RAG)

Data sources governance

Security logging & auditability

Confluence SOPs/runbooks

OSI layers & protocols

Containerization (Docker/Podman)

Model serving patterns

LLM security risks & mitigations

CIA risk analysis

Security certifications (CISSP/CISM/CC

RHCSA/RHCE

Outils

Confluence

Description du poste

CYBERSPACE OPERATIONS GENERATIVE ARTIFICIAL

IT Services

Type: Contract

Country: Belgium

City: Mons

Security: Needed

Company: NCIA

Essential Qualifications/Experience:

• Demonstrable 3+ years experience as a Red Hat Linux system administrator / platform engineer operating on-prem environments (servers, storage, networking, hardening, patching, backup/restore)
• Demonstrable 1+ years experience building and operating AI/ML platforms on-prem (GPU servers, CUDA stack, containers, model serving)
• Demonstrable 2+ years experience integrating enterprise authentication and authorization (AD/LDAP/SAML/OIDC), including RBAC and least-privilege design
• Demonstrable experience delivering AI-enabled cyber security use cases in at least two of the following domains: SOC, Threat Hunting, Incident Response, Digital Forensics, Malware Analysis
• Demonstrable experience implementing Retrieval-Augmented Generation (RAG) in production-like environments, including:
  • grounding/citations and evaluation methods
• Demonstrable experience integrating and governing multiple data sources, such as SIEM/SOAR, EDR, case management, threat intel, knowledge bases (e.g., Confluence), file shares/object stores, forensic repositories—while enforcing access controls
• Demonstrable experience with security logging and auditability for AI systems (access logs, admin activity logs, model usage telemetry as permitted by policy)
• Demonstrable experience producing and maintaining operational documentation in Atlassian Confluence (minimum 2 years), including SOP/SOI style documentation and runbooks
• Good knowledge of OSI layers and core protocols (TCP/IP, VLANs, routing basics, TLS)
• Strong knowledge of containerization (Docker/Podman) including GPU scheduling concepts
• Strong knowledge of model serving patterns (e.g., vLLM/TGI/llama.cpp-class runtimes, API gateways/reverse proxies, rate limiting)
• Knowledge of LLM security risks and mitigations:
• Ability to perform a structured CIA risk analysis (Confidentiality, Integrity, Availability) for the chosen toolset/models/data flows, and translate this into actionable mitigations
• At least one relevant certification in security / cloud / platform / AI security, such as:
• CISSP, CISM, CCSP
• Linux: RHCSA/RHCE or equivalent (Equivalent certifications may be accepted if demonstrably relevant.)

DUTIES/ROLE:

• Capture the current state (“as-is”) of the on-premise AI server capability and the supporting processes, including:
• Current architecture and deployment (hardware, virtualization/containers, GPU stack, storage, network zoning, backups, patching approach)
• Current AI toolset (frameworks, model runtimes/serving, vector DB, embedding models, LLMs, orchestration, prompt tooling, pipelines)
• Current security controls (authentication, RBAC, secrets management, certificate management, host hardening, network controls)
• Current data sources used or planned for use (SOC telemetry, EDR, SIEM, ticketing/case mgmt, threat intel, forensics repositories, malware sandboxes, knowledge bases/Confluence, etc.)
• Current logging/monitoring (system, application, model usage/audit logs), incident handling integration
• Current documentation: review and map existing SOPs/SOIs in Confluence and identify documentation gaps and misalignments with actual practice
• Workshops: organise up to 3 workshops with stakeholders (SOC/DFIR/Threat Hunting/IR/Platform admins) to validate the as-is workflow and priorities

Job requirements

All the mandatory requirements have to be met in order to apply.

• Demonstrable 3+ years experience as a Red Hat Linux system administrator / platform engineer operating on-prem environments (servers, storage, networking, hardening, patching, backup/restore) (Mandatory)
• Demonstrable 1+ years experience building and operating AI/ML platforms on-prem (GPU servers, CUDA stack, containers, model serving) (Mandatory)
• Demonstrable 2+ years experience integrating enterprise authentication and authorization (AD/LDAP/SAML/OIDC), including RBAC and least-privilege design (Mandatory)
• Demonstrable experience delivering AI-enabled cyber security use cases in at least two of the following domains: SOC, Threat Hunting, Incident Response, Digital Forensics, Malware Analysis (Mandatory)
• Demonstrable experience implementing Retrieval-Augmented Generation (RAG) in production-like environments, including: (Mandatory)
• grounding/citations and evaluation methods (Mandatory)
• Demonstrable experience integrating and governing multiple data sources, such as SIEM/SOAR, EDR, case management, threat intel, knowledge bases (e.g., Confluence), file shares/object stores, forensic repositories—while enforcing access controls (Mandatory)
• Demonstrable experience with security logging and auditability for AI systems (access logs, admin activity logs, model usage telemetry as permitted by policy) (Mandatory)
• Demonstrable experience producing and maintaining operational documentation in Atlassian Confluence (minimum 2 years), including SOP/SOI style documentation and runbooks (Mandatory)
• Good knowledge of OSI layers and core protocols (TCP/IP, VLANs, routing basics, TLS) (Mandatory)
• Strong knowledge of containerization (Docker/Podman) including GPU scheduling concepts (Mandatory)
• Strong knowledge of model serving patterns (e.g., vLLM/TGI/llama.cpp-class runtimes, API gateways/reverse proxies, rate limiting) (Mandatory)
• Knowledge of LLM security risks and mitigations: (Mandatory)
• secure prompt/data handling and redaction practices (Mandatory)
• Ability to perform a structured CIA risk analysis (Confidentiality, Integrity, Availability) for the chosen toolset/models/data flows, and translate this into actionable mitigations (Mandatory)
• At least one relevant certification in security / cloud / platform / AI security, such as: (Mandatory)
• CISSP, CISM, CCSP (Mandatory)
• Linux: RHCSA/RHCE or equivalent (Equivalent certifications may be accepted if demonstrably relevant.) (Mandatory)