Cyber Security Defender (SIEM)

Job Posting Organization:
The NATO Communications and Information Agency (NCIA) is a vital part of NATO, established to ensure the security" style="border-bottom: 1px dotted #007bff !important;">security and operational effectiveness of the Alliance's communications and information systems. With a mission spanning over 70 years, NCIA employs around 3000 civilian and military staff across 29 locations in Europe, North America, and Asia. The agency focuses on providing cutting-edge technology and cyber expertise to support NATO's critical operations, protect airspace, and maintain superiority in space. The organization values its workforce, aiming to hire, train, and retain the best talent to maintain its technological edge and ensure the security of its operations.

Job Overview:
The Cyber Security Defender position at NCIA is based in Mons, Belgium, and is part of the NATO Cyber Security Centre (NCSC). This role is crucial as the agency embarks on a transformation of its IT services to support NATO's Digital Endeavour. The NCSC is responsible for the lifecycle management of cyber security, providing specialized services that encompass scientific, technical, acquisition, operations, maintenance, and sustainment support for NATO's communications and information systems. The successful candidate will act as a Subject Matter Expert (SME) for SIEM and log collection services, providing technical assistance and advice to stakeholders, ensuring the proper management and development of data security systems, and adhering to ITIL standards throughout the lifecycle of these systems.

Duties and Responsibilities:
The Cyber Security Defender will have a range of responsibilities including acting as a main engineer and SME for SIEM and log collection services. The role involves providing technical advice and assistance to stakeholders, maintaining technical expertise, and contributing to projects related to data security systems. The individual will be responsible for the management and further development of these systems, ensuring they are installed, configured, and operating correctly. The position also requires support for Operations and Service Delivery management, covering all stages of the data security systems lifecycle, including Service Design, Transition, Operations, Change Management, and Continual Service Improvement. The candidate will need to ensure that data security systems align with dependencies on other systems or applications.

Required Qualifications:
Candidates must possess a Bachelor’s degree from a nationally recognized or certified university in a related discipline, along with at least 2 years of post-related experience. Alternatively, candidates without a university degree may qualify if they can demonstrate at least 6 years of extensive and progressive expertise in relevant duties. A minimum of 1 year of practical experience as a SIEM administrator in a large enterprise environment is required, along with hands-on experience in designing and maintaining distributed Splunk architectures. Candidates should have at least 2 years of expert-level experience related to SIEM and log collection management activities with Splunk Enterprise, and demonstrable experience in analyzing system, security, and application logs to diagnose faults and identify abnormal behaviors. Practical skills in writing Bash, Python, or Ansible scripts for automation, as well as solid Linux administration" style="border-bottom: 1px dotted #007bff !important;">system administration skills, are essential.

Educational Background:
The educational requirement for this position is a Bachelor’s degree from a nationally recognized or certified university in a related field. In exceptional cases, candidates may substitute the degree requirement with significant relevant experience, specifically at least 6 years of extensive expertise in duties related to the function of the post.

Experience:
The position requires candidates to have at least 2 years of relevant experience in cyber security, specifically in SIEM administration within a large enterprise environment. Candidates should also have hands-on experience in the design and maintenance of distributed Splunk architectures, as well as extensive experience in SIEM and log collection management activities.

Languages:
Fluency in English, both written and spoken, is mandatory for this position. Good communication skills are essential, as the candidate will need to articulate complex issues clearly to various audiences and teams. Additional language skills may be considered an asset but are not specified as mandatory.

Additional Notes:
The position offers a 5-year contract with a competitive tax-free salary, along with household and children's allowances. Expatriate staff will receive privileges including expatriation and education allowances where appropriate, as well as additional home leave. The role includes excellent private health insurance, generous annual leave of 30 days plus official holidays, and participation in the NATO Pension Scheme. The NCIA is committed to fostering an inclusive environment and values diversity in its workforce.