Second Line SOC Analyst (Splunk, Sentinel and Detection Engineering) for NATO with security clearance

WLG; Henegouwen; Sur place; EUR 70 000 - 110 000; Plein temps

Résumé du poste

WLG in Mons, Belgium is seeking a technical escalation point for a large defence security operations centre. You will validate investigations, perform deep log analysis, and design detections across Splunk, Sentinel and other security tools.

The role includes on‑call duties, mentoring, and collaboration with threat hunting to improve coverage and reduce false positives. Strong English and a related degree are required.

Qualifications

• Minimum three years in an SOC or related monitoring environment.
• Proven incident investigations, with clear, actionable recommendations.
• Fluent log extraction and interrogation from varied sources (Windows, Linux, etc.).
• Experience turning attacker techniques into working detections.
• Strong written and spoken English; professional communication under pressure.

Responsabilités

• Validate investigations, ensure closures, evidence and notes meet standards.
• Perform in-depth log analysis and triage across Splunk, Sentinel, and SIEMs.
• Provide on-call cover on a 24x7 roster for escalations.
• Design, test and maintain detections, alerts, and analytics across tools.
• Mentor junior analysts with feedback and coaching.
• Collaborate with threat hunting to automate detections where possible.
• Produce operational docs, run-books, and knowledge-base articles.
• Support project planning and secure integration of detections into live environments.

Connaissances

SOC analysis

Incident response

Log analysis

Threat hunting

Detection engineering

Automation

Formation

Bachelor's degree in a related discipline

Outils

Splunk

Microsoft Sentinel

Elastic Kibana

Wireshark

tcpdump

Zeek

Description du poste

Second line is where an alert stops being noise and becomes a decision.

You would be the technical escalation point in a large defence security operations centre in Mons, Belgium — validating what the first line produces, digging into the cases they cannot close, and building the detections that stop the same thing reaching them twice.

What You Would Be Doing

• Reviewing and validating investigations, supporting first-line analysts so that alert closures, escalations, evidence and notes meet the standard — complete, accurate and procedurally sound
• Acting as the technical escalation point for security monitoring: in-depth log analysis and threat triage across Splunk Enterprise Security, Splunk SOAR and Microsoft Sentinel, plus the supporting data sources and security appliances, and deciding what goes to incident handling
• Providing on-call cover as part of a 24x7 roster, so second-line escalations are answered round the clock
• Designing, developing, testing and maintaining detection rules, alerts and analytics across the monitoring tool-set — tuning logic, thresholds, allow-lists, suppression and severity so false positives fall and coverage of new threats rises
• Giving first-line analysts regular, constructive feedback and coaching on technique, analytical approach and reporting, and helping new joiners find their feet
• Supporting the duty second-line analyst through the week — watching open tasks, chasing pending actions, and flagging anything that threatens service continuity
• Taking part in purple-team exercises to test and improve detection coverage
• Working with the threat hunting team to turn their findings into automated detections wherever that is possible
• Contributing to service improvement: finding the workflow inefficiencies, the monitoring blind spots, and saying what should change
• Writing and updating the operational documentation, procedures, run-books and knowledge-base articles the whole team relies on
• Representing the monitoring function in project planning, implementation and transition, so visibility requirements are considered early, and advising on detection content, log-source integration and security-tool configuration
• Working with colleagues across the wider security organisation and with external partners
• Ad‑hoc work when it is needed — special investigations, projects, whatever keeps the operation effective

What you would bring

• At least three years hands‑on in a security operations centre or a closely related monitoring environment
• A proven expert‑level record of analysing complex security incidents and writing clear, authoritative reports and recommendations for the teams and partners who act on them
• Real fluency extracting, normalising and interrogating raw log data from varied sources — Windows event logs, Linux syslog, Sysmon, endpoint detection platforms such as Microsoft Defender, SentinelOne or CrowdStrike — using Splunk, Microsoft Sentinel or Elastic Kibana. Filtering, correlating and visualising events to verify an alert, reconstruct what an attacker did across hosts, and hand over evidence someone can act on
• Hands‑on packet capture analysis with Wireshark, tcpdump or Zeek — pulling traffic apart to corroborate an alert and rebuild a timeline
• The ability to turn attacker techniques and threat intelligence into working detection logic, and to run structured peer reviews of other analysts' investigations that actually find the gaps
• Designing, developing and maintaining detections across monitoring, endpoint and cloud security tooling — Splunk, Microsoft Sentinel, Azure, AWS
• Supporting or mentoring less experienced analysts, with feedback they can use
• Practical automation work: spotting the repetitive manual task and building the enrichment or workflow that removes it
• Strong written and spoken communication — investigation notes, escalation summaries and documentation that read well under pressure
• Professional English
• A bachelor's degree in a related discipline with three years of related experience — or, exceptionally, five years of extensive and progressive expertise in this kind of work
• A relevant certification such as CISSP, CISM, a GIAC credential (GCIH, GCFA, GSEC) or CompTIA CySA+

Nice to have

• A degree in cyber security, IT or computer science
• Time in a regulated, high-control environment — defence, government, financial services or comparable
• Cloud‑native security monitoring on Azure or AWS, and hybrid estates
• Building detections from network and edge devices such as Cisco, Fortinet, Palo Alto or similar
• Work for or with a military or governmental organisation

Why this one is worth a look

Detection engineering and deep analysis in the same seat, at a scale where the telemetry is genuinely interesting and the escalations are real.