Security Monitoring Platform Engineer (Corelight, NetWitness, Firepower) for NATO with security clearance

WLG; Henegouwen; On-site; EUR 60,000 - 90,000; Full time

Job summary

WLG in Mons, Belgium, is seeking a hands-on security monitoring lead to own the organisation's network visibility, traffic aggregation and packet capture across multiple networks and data centres.

You will manage the full lifecycle of monitoring platforms, tune data collection for completeness, and work with analysts to keep coverage aligned with defence objectives. Proficiency with Linux and network troubleshooting is essential, plus a CISM/CISSP/GIAC-style certification.

Qualifications

• Expert knowledge of network security monitoring and cyber defence operations.
• Experience with large, distributed monitoring across sites or data centres.
• Experience with Firepower, Corelight, and NetWitness.
• Strong network visibility and packet capture expertise.
• Fluent professional English.

Responsibilities

• Run the network visibility and security monitoring capability the operations centre depends on.
• Own the full lifecycle of these platforms: deployment, upgrades, obsolescence and decommissioning.
• Tune monitoring, aggregation and packet capture for complete and useful data.
• Watch platform health, data quality, retention and storage, and close visibility gaps.
• Troubleshoot Linux, network and data collection problems across the monitoring estate.
• Collaborate with analysts and detection engineers to keep coverage aligned with needs.
• Participate in capacity planning, audits, site surveys and cyber defence exercises.

Skills

Network security monitoring

Distributed monitoring

Packet capture

Linux network troubleshooting

Cyber security certification

Relevant degree / experience

Fluent English

Education

Bachelor's degree in a relevant field

Tools

Firepower

Corelight

NetWitness

Packet broker

Job description

A security operations centre can only detect what it can see. You would own what it sees with.

A multinational defence organisation in Mons needs one person to properly own its security monitoring, traffic aggregation and packet capture platforms across many networks, sites and data centres.

What You Would Be Doing

• Running the network visibility and security monitoring capability the operations centre depends on
• Owning the full lifecycle of these platforms: deployment, upgrades, obsolescence and decommissioning
• Tuning monitoring, aggregation and packet capture so the collected data is complete and useful
• Watching platform health, data quality, retention and storage, and closing visibility gaps
• Troubleshooting Linux, network and data collection problems across the monitoring estate
• Working with analysts and detection engineers so coverage keeps up with what they need to find
• Capacity planning, audit support, site surveys and taking part in cyber defence exercises

What you would bring

• Expert knowledge of network security monitoring and cyber defence operations
• Hands-on experience with large, distributed monitoring across many sites or data centres
• Enterprise work with tools such as Firepower, Corelight and NetWitness
• Strong network visibility, packet broker and packet capture experience
• Linux and network troubleshooting down to packet flow and interfaces
• A cyber security certification such as CISM, CISSP or GIAC
• A relevant degree with two years of experience, or six years of progressive experience instead
• Fluent professional English

Why this one is worth a look

If you know the difference between a dashboard that is green and a capture that is actually complete, this one is for you.