Network Security Tool Manager for NATO with security clearance

WLG; Henegouwen; Sur place; EUR 65 000 - 90 000; Plein temps

Résumé du poste

NATO Operations Centre in Mons, Belgium seeks an expert to own and operate the network visibility and security monitoring capabilities across multiple sites. You will oversee installation, configuration, and life-cycle management of monitoring and packet capture tech, ensuring data quality and reliable threat visibility.

You will work with security analysts to close visibility gaps, troubleshoot Linux and network issues, and contribute to architecture design and operational governance in a

Qualifications

• Expert knowledge of network security monitoring and cyber defence in an enterprise environment.
• Hands-on experience supporting large-scale, distributed monitoring across many networks and sites.
• Experience with Firepower, Corelight and NetWitness preferred.

Responsabilités

• Delivering and maintaining the network visibility and security monitoring capability the operations centre works from.
• Acting as the subject matter expert for operation, configuration and lifecycle of monitoring and packet capture tech.
• Managing lifecycle end to end: deployment, configuration, maintenance, upgrades, obsolescence and decommissioning.
• Configuring and tuning monitoring to ensure reliable data collection for meaningful analysis.
• Watching platform health, data quality, retention, storage use and performance.
• Troubleshooting Linux, network, connectivity and data collection issues across the monitoring environment.
• Keeping documentation up to date with architecture diagrams and procedures.
• Supporting design of new monitoring solutions and integration with analytics and incident management tooling.
• Working with security analysts to keep monitoring coverage aligned with detection needs.
• Capacity planning, scalability assessment and governance for cyber defence tech.
• Supporting cabling, site surveys and deployment planning for monitoring infra; participating in cyber defence exercises.

Connaissances

Network security monitoring

Cyber defence operations

Enterprise-scale monitoring

Linux troubleshooting

Formation

Bachelor's degree in a related discipline

CISM, CISSP or GIAC Security certification

Two years of relevant experience

Outils

Firepower

Corelight

NetWitness

Packet capture

Description du poste

A NATO cyber security operations centre in Mons can only detect what it can see. The platforms that give it that visibility - security monitoring, traffic aggregation and full packet capture across many networks, sites and data centres - need one person who owns them properly. That is this role.

What You Would Be Doing

• Delivering and maintaining the network visibility and security monitoring capability the operations centre works from.
• Acting as the subject matter expert for the operation, configuration and lifecycle of security monitoring and packet capture technology.
• Managing that lifecycle end to end: deployment, configuration, maintenance, upgrades, obsolescence and decommissioning.
• Configuring and tuning monitoring, traffic aggregation and packet capture so the data collection is reliable and the analysis is worth doing.
• Watching platform health, availability, data quality, retention, storage use and performance.
• Finding and closing the visibility gaps that would otherwise blunt threat detection.
• Troubleshooting Linux, network, connectivity, performance and data collection problems across the monitoring environment.
• Keeping the documentation real - architecture diagrams, inventories, operating procedures, support information.
• Supporting the design of new monitoring solutions, and their integration with the wider analytics and incident management tooling.
• Working with the security analysts and the detection engineers so monitoring coverage keeps up with what they need to detect.
• Capacity planning and scalability assessment, and the compliance, audit and assurance work that comes with cyber defence technology.
• Supporting cabling, deployment planning and site surveys for monitoring and visibility infrastructure, and taking part in cyber defence exercises when they run.

What They Are Looking For

• Expert knowledge of network security monitoring and cyber defence operations in an enterprise monitoring environment.
• Extensive hands on experience supporting large scale, distributed security monitoring across multiple networks, sites, segments or data centres.
• Enterprise-scale work with monitoring and traffic-capture tooling of the Firepower, Corelight and NetWitness kind.
• Strong hands on work with network visibility, traffic aggregation, packet brokers and packet capture.
• Proven platform health and performance monitoring, capacity management, troubleshooting and operational governance.
• A deep grasp of how enterprise networks are built and how traffic actually moves through them.
• Linux and network troubleshooting: connectivity, packet flow, interfaces, performance and system level diagnostics.
• Practical experience of cabling, site surveys and the physical side of deploying monitoring infrastructure.
• Confident with the signals security tooling produces: gathering them, tying related events together, spotting an attack and going looking for one.
• Fluent professional English.
• A relevant cyber security certification - CISM, CISSP or GIAC Security.
• A bachelor's degree in a related discipline with two years of relevant experience; exceptionally, six years or more of progressive experience in the same work instead.

Also valued

• Designing large scale security monitoring and network visibility architectures.
• Integrating monitoring tools with SIEM and SOAR platforms.
• Automation, scripting or orchestration.
• Major platform upgrades, migrations, refreshes and service transition.
• Previous work in an international environment with both military and civilian elements, and a working knowledge of how NATO is organised.

Practical detail

• Fully on site in Mons, Belgium, in a normal office environment. Equipment is provided for restricted information.
• 5 October to 30 December 2026, 400 hours in total.
• Occasional travel to other locations in support of operational duties, reimbursed under NATO travel rules. Travel inside the duty country counts as commuting.
• You must hold a valid clearance and be a citizen of a NATO member country.

If you have kept a sensor estate honest at scale - and you know the difference between a dashboard that is green and a capture that is actually complete - this one is for you.