Second-Line CSOC Security Event Analyst (NATO SECRET)

EMW; Henegouwen; Hybride; EUR 70 000 - 90 000; Plein temps

Résumé du poste

EMW is seeking a Second Line Security Event Analyst to join the on-site CSOC in Mons, Belgium. The role involves reviewing investigations, escalating complex cases, and delivering 24x7 on-call support for second-line security operations.

You will design and maintain detection rules across SIEM/EDR tools, tune alerts to reduce false positives, and mentor junior analysts. Strong English skills and NATO SECRET clearance are required, with 3+ years in a SOC environment.

Qualifications

• The candidate must have a currently active NATO SECRET security clearance.
• Bachelor's degree or five years of related experience if no degree.
• Minimum three years of hands-on SOC/CSOC/GSOC experience.
• Proven track record in in-depth cyber-incident analysis and reporting.
• Expertise extracting and analyzing logs from diverse sources using SIEM/EDR tools.
• Hands-on PCAP analysis with Wireshark, tcpdump or Zeek.
• Ability to translate attacker TTPs into detection logic.
• Experience with SOAR and automation to improve workflows.
• Strong written and verbal communication; professional English.
• Relevant cyber-security certifications (CISSP, CISM, GCIA, etc.).

Responsabilités

• Review and validate investigations, supporting First-Line Analysts to ensure alert closures meet standards.
• Act as technical escalation point for cyber-security monitoring using SIEM/SOAR platforms.
• Provide on-call support as part of a 24x7 roster for second-line escalations.
• Design, develop, test and maintain detection rules, alerts and analytics.
• Adjust logic, thresholds, and suppression rules to reduce false positives.
• Provide feedback and coaching to First-Line Analysts and assist onboarding.
• Support weekly operational duties and highlight risks to service continuity.
• Participate in purple teaming events to test detection coverage.
• Collaborate with Threat Hunting to operationalize findings into detections.
• Write and update SOPs, run-books, and knowledge-base articles.
• Represent CSOC in project planning and provide expertise on detection-content design.
• Collaborate with internal and external stakeholders across Defend-branch and NCI Agency.
• Perform other duties including ad-hoc projects to strengthen CSOC resilience.

Connaissances

SOC operations

Threat analysis

Log analysis

SOAR automation

Attention to detail

Formation

Bachelor's degree in a related discipline

Outils

Splunk

Microsoft Sentinel

Elastic Kibana

Description du poste

EMW is seeking a Second Line Security Event Analyst to join the on-site CSOC in Mons, Belgium. The role involves reviewing investigations, escalating complex cases, and delivering 24x7 on-call support for second-line security operations.

You will design and maintain detection rules across SIEM/EDR tools, tune alerts to reduce false positives, and mentor junior analysts. Strong English skills and NATO SECRET clearance are required, with 3+ years in a SOC environment.