Senior Splunk Engineer

Spektrum; Henegouwen; Hybride; EUR 75 000 - 120 000; Plein temps

Résumé du poste

Spektrum in Belgium is seeking a Senior Cyber Security Engineer to support the CDSA platform for NATO NCIA. The role blends hands-on Splunk development with operational support, collaborating with development contractors and CyOC users.

You will design dashboards, develop data models, and help drive platform improvements while ensuring security and compliance in a high-security environment. Hybrid work arrangement with travel to NATO sites as required.

Qualifications

• Minimum 3 years hands-on Splunk experience with dashboards, data models and KVStore.
• Strong knowledge of cybersecurity concepts and threat management.
• Experience bridging operational needs with development teams.
• Experience with CDSA or similar large Splunk-based platforms is a plus.

Responsabilités

• Design, develop and maintain CDSA dashboards and visualizations in Splunk.
• Build data models, macros and scheduled searches to support CDSA.
• Support CyOC users and translate requirements into technical tasks.
• Validate contractor deliverables and assist in early life support.
• Improve dashboards, data pipelines and platform functionality.

Connaissances

Splunk dashboards

Splunk data models

Python Bash scripting

REST APIs

Databases

Cybersecurity concepts

Operational-dev balance

Formation

Bachelor's degree in related discipline

Outils

Cribl

DB Connect

Splunk UI development

Description du poste

Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.

Who we are supporting

The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium.

The NCIA provides a wide range of services, including:

• Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats.
• Command and Control Systems: The NCIA develops and maintains the systems used by NATO's military commanders to plan and execute operations.
• Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
• Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks.
• Information Management: The NCIA manages NATO's information technology infrastructure, including its databases, applications, and servers.

Overall, the NCIA plays a critical role in ensuring the security and effectiveness of NATO's communication and information technology capabilities.

The program

Assistance and Advisory Service (AAS)

The NATO Communications and Information Agency (NCI Agency) is NATO’s principal C3 capability deliverer and CIS service provider. It provides, maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV, and, when required, stand together in the face of attack under Article V.

To provide these critical services, in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorise's: NATO International Civilians (NIC)'s, Military (Mil), and Interim Workforce Consultants (IWC)'s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce.

Role ID – C005299

Role Duties and Responsibilities

Senior Cyber Security Engineer to support the Cyber Defence Situational Awareness (CDSA) platform.

The role combines technical development work (mainly in Splunk) with operational support and close coordination with both the development contractor and CyOC users. The role requires strong ownership, the ability to translate operational requirements into technical solutions, and a proactive approach to improving the platform. Under the direction of the DICE Team Lead the contractor shall:

Technical Development & Maintenance

• Design, develop and maintain CDSA dashboards, visualizations, and user interface components in Splunk.
• Build and optimize data models, KVStore collections, scheduled searches, macros and related Splunk objects.
• Implement enhancements and defect fixes based on operational priorities and user feedback.
• Support the integration of new data sources and tools into CDSA (e.g. PLM, ACPV, Cribl, etc.).
• Develop automation and supporting scripts (Python, Bash or similar).

Operational Support & CyOC Coordination

• Provide day-to-day technical and operational support to Cyber Operations Centre (CyOC) users.
• Act as a technical bridge between CyOC operational needs and the development contractor (Infigo/King ICT).
• Gather, prioritize and translate user feedback into clear technical requirements.
• Validate and test contractor deliverables before production deployment.
• Support Early Life Support (ELS) activities for new features and releases.
• Monitor dashboard performance, data quality, and overall platform health.
• Identify and drive improvements to existing dashboards, data pipelines and platform functionality.
• Contribute to the technical roadmap and evolution of the CDSA platform.

Essential Skills, Experience and Certifications

• At least 3 years practical and hands-on experience in:
  • Splunk (dashboard development, data models, KVStore, macros, scheduled searches).
  • Splunk UI development and visualization best practices.
  • scripting (Python, Bash, or similar).
  • Interacting with REST APIs or similar
  • Interacting with Databases
• Solid understanding of cybersecurity concepts (vulnerability management, threat intelligence, incident management).
• Proven ability to balance operational support with hands-on development

Skills:

• Good communication and analytical skills — able to translate technical topics for operational users and vice versa.
• Strong analytical and problem-solving skills.
• Ability to work operationally with end users while also performing technical development work.

Desirable Skills, Experience and Certifications

• certification in Splunk Enterprise
• certification in Machine Learning and/or Artificial Intelligence
• Previous experience with CDSA or similar large Splunk-based platforms.
• Experience with data integration projects (REST APIs, DB Connect, Cribl, etc.).
• Knowledge of MITRE ATT&CK or vulnerability scoring methodologies.
• Prior experience with Machine Learning and Artificial Intelligence
• Previous work in NATO, military, or high-security environments.

Education

• A minimum requirement of a Bachelor's degree at a nationally recognised/certified University in a related discipline and 3 years post-related experience, or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience that is/are of interest to NCIA, that is, at least 10 years extensive and progressive expertise in duties related to those in this Statement of Work.
• Business English

Working Policy

• Hybrid (80% on-site, 20% off-site)

Travel

• Some travel to other NATO sites may be required

Security Clearance

• Valid National or NATO Secret personal security clearance