Splunk Engineer

Spektrum; Henegouwen; On-site; EUR 65,000 - 90,000; Full time

Job summary

Spektrum is seeking a SIEM Engineer to join our on-site team supporting NATO-related operations. You will act as SME for SIEM and log collection services, focusing on Splunk deployments, data security systems, and incident response readiness in a regulated environment.

The role requires strong Linux administration, scripting (Python/ Bash/ Ansible), and the ability to communicate with stakeholders and executives. Occasional travel to NATO sites may be required.

Qualifications

• Bachelor's degree + 2 years' relevant experience (or 5+ years in lieu of a degree).
• At least 1 year of practical Splunk SIEM administration in a large enterprise.
• Hands-on experience designing and maintaining distributed Splunk architectures.
• At least 2 years of expert-level experience in SIEM and log collection management.
• Experience analyzing logs to diagnose faults and spot abnormal behavior.
• Solid Linux administration and networking knowledge with troubleshooting skills.

Responsibilities

• Act as SME for SIEM and log collection services, advising stakeholders.
• Manage and develop data security systems, ensuring proper installation and operation.
• Monitor all system components and take actions to resolve issues.
• Ensure systems operate within KPIs defined in SLAs.
• Support ITIL-based service design, transition, and operations processes.
• Coordinate with service delivery managers and NATO/industry partners.

Skills

SIEM administration

Splunk

Linux

Python

Ansible

Regex

Education

Bachelor’s degree in related discipline

Tools

Splunk Enterprise

Git

Ansible

Python

Job description

Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.

Who we are supporting

The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium.

The NCIA provides a wide range of services, including:

• Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats.
• Command and Control Systems: The NCIA develops and maintains the systems used by NATO's military commanders to plan and execute operations.
• Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
• Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks.
• Information Management: The NCIA manages NATO's information technology infrastructure, including its databases, applications, and servers.

Overall, the NCIA plays a critical role in ensuring the security and effectiveness of NATO's communication and information technology capabilities.

The program

Assistance and Advisory Service (AAS)

The NATO Communications and Information Agency (NCI Agency) is NATO’s principal C3 capability deliverer and CIS service provider. It provides, maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV, and, when required, stand together in the face of attack under Article V.

To provide these critical services, in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorise's: NATO International Civilians (NIC)'s, Military (Mil), and Interim Workforce Consultants (IWC)'s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce.

Role Background

• You will act as one of the main engineers and subject matter experts for SIEM and log collection services, managing and developing the data security systems that underpin cyber monitoring. The role calls for hands‑on Splunk expertise in a large, regulated environment, and the ability to support stakeholders, operations and service delivery management throughout the service lifecycle.

Role Duties and Responsibilities

• Act as SME for SIEM and log collection services, advising stakeholders and providing technical assistance and contributions to data security projects
• Manage and develop the data security systems, ensuring they are installed, configured and operating correctly
• Monitor all system components continuously and take technical and non-technical action to resolve issues
• Keep systems operating within KPIs defined in SLAs with NCSC customers
• Support Operations and Service Delivery management following ITIL standards (Service Design, Transition, Operations, Change Management, Continual Service Improvement)
• Support integration with external tools and related activities
• Proactively identify and propose improvements for an up‑to‑date, stable environment
• Prepare business justification, documentation and implementation plans for the Change Management Board, and implement approved changes in coordination with stakeholders
• Coordinate with service delivery managers, end users and stakeholders, and communicate with other NATO entities and industry partners where required
• Develop and maintain guidelines, SOPs, system and service design documents and other supporting documentation
• Produce technical and executive-level reports, and deliver briefings up to NATO executive level
• Provide occasional on‑call support to maintain the availability of SIEM monitoring infrastructure, and support 24/7 incident response during enterprise‑level cyber incidents when required

Essential Skills, Experience and Certifications

• Bachelor’s degree from a nationally recognised university in a related discipline plus 2 years’ relevant experience (or 5+ years of extensive, progressive experience in lieu of a degree)
• At least 1 year of extensive practical experience as a SIEM administrator with Splunk in a large enterprise environment (deployment, installation, configuration and maintenance)
• Hands‑on experience designing and maintaining distributed Splunk architectures
• At least 2 years of expert‑level experience in SIEM and log collection management
• Demonstrable experience analysing and interpreting system, security and application logs to diagnose faults and spot abnormal behaviour
• Hands‑on systems and tools administration experience, especially in Linux, with solid troubleshooting skills
• Comprehensive knowledge of computer and communication security, networking, and the vulnerabilities of modern operating systems and applications
• Practical scripting skills (Bash, Python or Ansible) to automate repetitive tasks
• Solid understanding of regular expressions
• Ability to write clear, concise technical documentation and procedures
• Strong written and verbal communication, able to explain complex issues to varied audiences
• English professional level

Desirable Qualifications

• Bachelor’s degree in Cyber Security, IT, Computer Science or a related discipline
• Experience in a regulated, high‑control environment (defence, government, financial services)
• Extensive administration experience with Splunk Enterprise Security, SOAR and UBA
• Experience developing Splunk applications and managing Splunk content (Enterprise Security, Advanced Search and Reporting)
• Experience creating or modifying custom parsers
• Git and Ansible experienceScripting or software engineering (Python, shell, PowerShell) and API‑based system automation
• Solid grasp of information security practices and the CIA triad
• ITIL Service Management certification
• Hands‑on experience with network infrastructure and virtualised environments
• Log collection experience in cloud environments (Azure or AWS)
• Background in CERTs or security offices, or supporting a military or governmental organisation
• Industry‑leading security certification (CISSP, CISM, CISA, GSNA, SANS GIAC)

Working Policy

• Full‑time on site. Occasional work out‑side office hours may be needed (on‑call)

Travel

• Some travel to other NATO sites may be required

Security Clearance

• Valid National or NATO Secret personal security clearance