Splunk Engineer

Brevco Services; Henegouwen; Hybrid; EUR 85,000 - 110,000; Full time

Job summary

Brevco Services is seeking a skilled SIEM Engineer to join our Cyber Security Data team. You will lead Splunk-based log collection efforts, develop secure data-handling practices, and advise stakeholders on security event analysis.

The role focuses on maintaining a robust SIEM environment and improving operational security across the enterprise. The position requires extensive Linux experience, scripting capabilities (Bash/Python/Ansible), and strong communication to document procedures and

Qualifications

• Bachelors degree or 5+ years related experience.
• 1+ year SIEM admin with Splunk in large enterprise.
• 2+ years expertise in SIEM and log collection.
• Analyzing logs to diagnose faults and spot anomalies.
• Systems/tools administration, esp. Linux.
• Knowledge of security, networking and OS vulnerabilities.
• Scripting in Bash, Python or Ansible for automation.
• Strong Linux admin and troubleshooting skills.
• Regex knowledge.
• Clear technical documentation practice.
• Good written and verbal communication.

Responsibilities

• Act as SME for SIEM and log collection within Cyber Security Data team.
• Provide advice and maintain technical expertise for related projects.
• Manage and develop the data security systems.
• Occasional on-call support to ensure operational availability.
• ItIL-aligned support across service lifecycle (Design, Transition, Operations, CSI).
• Ensure data security systems are installed, configured, and monitored.
• Coordinate with stakeholders and NATO entities as required.
• Develop and maintain technical and operational documentation.
• Create reports and briefings for audiences up to executive level.
• Perform other duties as required.

Skills

Bachelor's degree

SIEM administrator

Splunk

Log collection

Linux systems

Regular expressions

Scripting: Bash

Scripting: Python

Ansible

Technical documentation

Communication skills

Education

Bachelor's degree

Cyber Security degree

Tools

Git

Splunk Enterprise Security

Splunk SOAR

Splunk UBA

Ansible

Job description

· Bachelor's degree from a nationally recognised/certified university in a related discipline andtwoyears post ‑ related experience. Alternatively, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience of interest to the NCI Agency, provided the candidate has at least fiveyears of extensive and progressive expertise in duties related to the function of the post

· 1+ year of extensive practical experience as SIEM administrator with Splunk in large enterprise environment (deployment, installation, configuration and maintenance). Hands‑on experience in the design and maintenance of distributed Splunk architectures

· 2+ years and expert level experience related to SIEM and Log collection management activities

· Demonstrable experience of analysing and interpreting system, security and application logs in order to diagnose faults and spot abnormal behaviours

· Practical hands‑on experience in systems and tools administration, especially Linux environment

· Comprehensive knowledge of the principles of computer and communication security, networking, and the vulnerabilities of modern operating systems and applications

· Practical skills in writing Bash, Python or Ansible scripts to support repetitive tasks automation

· Solid Linux system and application administration and troubleshooting skills

· Solid understanding of regular expressions

· Ability to develop clear and concise technical documentation, including procedures

· Good communication abilities, both written and verbal, with the ability to clearly and successfully articulate complex issues to a variety of audiences and teams

Desirable Qualifications/Experience:

· University degree (Bachelor's) in Cyber Security, Information Technology, Computer Science or a related discipline

· Experience working in a regulated, high control environment such as defence, government, financial services or other enterprise sectors

· Extensive practical experience (as system administrator) with Splunk Enterprise security, Splunk SOAR and Splunk UBA. Practical experience with Git software

· Hands‑on experience with Ansible as an automation technology. Experience in creation/modification of custom parsers

· Software engineering including programming and/or scripting knowledge (python, shell scripting, PowerShell)

· Prior experience automating interactions between systems using APIs

· A solid understanding of Information Security Practices, relating to the Confidentiality, Integrity and Availability of information (CIA triad.)

· ITIL Service Management certifications

· Experience in developing Splunk Applications

· Content management experience in Splunk, especially Enterprise Security and Advanced Search and Reporting

· Hands‑on experience with network infrastructure and virtualised environments

· Previous experience working for Cyber Security related organisations (CERTs, security offices)

· Experience with log collection in cloud environment such as Azure or AWS

· Language proficiency in English: meet or exceed the NATO STANAG 6001 Level 3 "Professional Proficiency"

· Training/certifications:

ü Possessing industry leading certification in the area of Cyber Security such as CISSP, CISM, CISA, GSNA, and SANS GIAC

· Experience in working for or supporting a military or governmental organization

DUTIES/ROLE:

· Act as one of the main engineers and Subject Matter Expert (SME) for SIEM and Log collection services within the Cyber Security Data team

· As the SME, you will provide advice and technical assistance to other stakeholders, maintain technical expertise, awareness, and developments in related new technologies, and provide technical contributions to any projects related to the data security systems

· Be responsible for management and further development of the data security systems

· The contractor may occasionally be required to provide on‑call support and intervene in the event of an issue to ensure the continued operational availability of the SIEM monitoring infrastructure

· Following ITIL standards, provide support to Operations and Service Delivery management covering all stages of the data security systems lifecycle (e.g. Service Design, Transition, Operations, Change Management and Continual Service Improvement)

· Ensure that data security systems are installed, configured, and operating correctly and in line with dependencies with others systems or applications required

· Ensure that all system components are continuously monitored and take appropriate technical and non‑technical actions for solving detected issues

· Ensure that data security systems operate within any KPI's, as defined in Service Level Agreements with NCSC customers

· Support integration with external tools and any associated activities

· Proactively identify and propose system improvements to ensure an up‑to‑date and stable environment

· Justify business needs, prepare documentation and implementation plan for the Change Management Board. Implement the approved changes following co‑ordination with other stakeholders

· Coordinate with service delivery managers, end users and other stakeholders in support of related services; communicate with other NATO entities as well as industry partners where required

· Develop and maintain documentation guidelines, standard operating procedures, system and service design documents and other relevant documentation that support management of the data security systems

· Create technical and/or executive level reports as required; organise and deliver presentations and briefings for various audience up to NATO executive level

· Perform other duties as may be required

Job requirements

All the mandatory requirements have to be met in order to apply.

• Bachelors degree from a nationally recognised/certified university in a related discipline andtwoyears post‑related experience. Alternatively, the lack of a university degree may be compensated by the demonstration of a candidates particular abilities or experience of interest to the NCI Agency, provided the candidate has at least fiveyears of extensive and progressive expertise in duties related to the function of the post (Mandatory)

• 1+ year of extensive practical experience as SIEM administrator with Splunk in large enterprise environment (deployment, installation, configuration and maintenance). Hands‑on experience in the design and maintenance of distributed Splunk architectures (Mandatory)

• 2+ years and expert level experience related to SIEM and Log collection management activities (Mandatory)

• Demonstrable experience of analysing and interpreting system, security and application logs in order to diagnose faults and spot abnormal behaviours (Mandatory)

• Practical hands‑on experience in systems and tools administration, especially Linux environment (Mandatory)

• Comprehensive knowledge of the principles of computer and communication security, networking, and the vulnerabilities of modern operating systems and applications (Mandatory)

• Practical skills in writing Bash, Python or Ansible scripts to support repetitive tasks automation (Mandatory)

• Solid Linux system and application administration and troubleshooting skills (Mandatory)

• Solid understanding of regular expressions (Mandatory)

• Ability to develop clear and concise technical documentation, including procedures (Mandatory)

• Good communication abilities, both written and verbal, with the ability to clearly and successfully articulate complex issues to a variety of audiences and teams (Mandatory)

• University degree (Bachelors) in Cyber Security, Information Technology, Computer Science or a related discipline (Nice to have)

• Experience working in a regulated, high control environment such as defence, government, financial services or other enterprise sectors (Nice to have)

• Extensive practical experience (as system administrator) with Splunk Enterprise security, Splunk SOAR and Splunk UBA. Practical experience with Git software (Nice to have)

• Hands‑on experience with Ansible as an automation technology. Experience in creation/modification of custom parsers (Nice to have)

• Software engineering including programming and/or scripting knowledge (python, shell scripting, PowerShell) (Nice to have)

• Prior experience automating interactions between systems using APIs (Nice to have)

• A solid understanding of Information Security Practices, relating to the Confidentiality, Integrity and Availability of information (CIA triad.) (Nice to have)

• ITIL Service Management certifications (Nice to have)

• Experience in developing Splunk Applications (Nice to have)

• Content management experience in Splunk, especially Enterprise Security and Advanced Search and Reporting (Nice to have)

• Hands‑on experience with network infrastructure and virtualised environments (Nice to have)

• Previous experience working for Cyber Security related organisations (CERTs, security offices) (Nice to have)

• Experience with log collection in cloud environment such as Azure or AWS (Nice to have)

• Language proficiency in English: meet or exceed the NATO STANAG 6001 Level 3 Professional Proficiency (Nice to have)

• Training/certifications: (Nice to have)

Possessing industry leading certification in the area of Cyber Security such as CISSP, CISM, CISA, GSNA, and SANS GIAC (Nice to have)

• Experience in working for or supporting a military or governmental organization (Nice to have)