Senior Cyber Security Defender (Threat Hunting) at NATO

Mons, Wallonia, Belgium -

Full Time

Start Date

Immediate

Expiry Date

25 May, 26

Salary

0.0

Posted On

24 Feb, 26

Experience

2 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Threat Hunting, Python, PowerShell, Azure, AWS, SIEM, Splunk, Microsoft Sentinel, APT TTPs, Digital Forensic Artefacts Analysis, MITRE ATT&CK Framework, Windows System Administration, Linux System Administration, VMware System Administration, Incident Handling, Scripting

Industry

IT Services and IT Consulting

Description

Who we are: For more than 70 years, NATO’s mission has been to preserve peace and security in the Alliance for nearly one billion citizens. The NATO Communications and Information Agency (NCIA) and its predecessors have worked tirelessly in providing the means that enable the connectedness and togetherness that keep our Alliance strong. We are the NCIA, a team of 3000 civilian and military staff in 29 locations throughout Europe, North America and Asia. Our technology and cyber experts allow NATO to conduct critical operations, protect NATO’s airspace, make data-driven decisions, defend against cyber-attacks, secure NATO networks and maintain superiority in space. This is all possible because of our greatest force, our people. In order to keep this edge we aim to hire, train and retain the very best staff. Our staff members represent both the diversity and unity of our Alliance. When you join the NCIA, you will be part of an organization where you can contribute authentically to the mission and purpose of NATO and help us keep our technological edge. About the job: Based in Mons, Belgium, you will join the Agency as we embark on a journey to transform our IT services to support NATO’s Digital Endeavour. You will join NATO Cyber Security Centre (NCSC), which is responsible for planning and executing all lifecycle management activities for cyber security. In executing this responsibility, NCSC provides specialist cyber security-related services covering the spectrum of scientific, technical, acquisition, operations, maintenance, and sustainment support, throughout the lifecycle of NATO Communications and Information Systems (CIS). We are looking for a driven and enthusiastic Senior Cyber Security Defender who will take on the following roles and responsibilities: Provide technical and expert support for to the 24/7 Cyber Security Incident Response Team’s processes, during normal working hours and on-call duties, including weekends and holidays; Support Cyber Security Incident Response/Threat Hunting Team covering one or multiple physical locations, including NATO Alliance Operations and Missions; Develop tools, scripting, automation and integrations to automate activities as much as possible, mostly using Python and PowerShell; Conduct threat hunting campaigns and maintain threat hunting analysis tools and environments on premises or in the cloud. For a full list of duties, please review the job description on the NCIA career site. Note that on-call duties after working hours, on weekends or holidays are required. You may require to work on 12 hours pattern during weekdays and that in case of an enterprise-level Cyber Incident, you may be required to work extended hours and on shifts. About you: The valuable knowledge and experience that you bring to this role are: Bachelor’s degree at a nationally recognised/certified University in a related discipline and 3 years post-related experience. Or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate’s particular abilities or experience that is/are of interest to NCI Agency, that is, at least 10 years extensive and progressive expertise in duties related to the function of the post; Extensive knowledge of threat hunting techniques and technologies; Excellent ability to recognise when an IT network/system has been attacked, be able to take immediate action to limit damage and to escalate the event to higher authority; Practical experience with cyber security in cloud-based environments such as Azure and AWS; Proficiency in assessing security vulnerabilities of operation systems and software; Practical experience and knowledge of Security Information & Event Management (SIEM); Proven experience with Splunk or Microsoft Sentinel; Good knowledge of Advanced Persistent Threats (APT) Tactics Techniques and Procedures (TTPs); Practical experience in the analysis of digital forensic artefacts in the context of cyber security; Good knowledge of the principles of computer and communications security, networking, and vulnerabilities of modern operating systems and applications; Good understanding of the MITRE ATT&CK framework and its applicability in Cyber; Good practical experience in Windows, Linux and VMware system administration; Good knowledge of cyber security incident handling; Practical experience in scripting (Python, PowerShell); Excellent communication and analytical skills; Experience in leading small teams, preferably in international environment; Fluency in English, both written and spoken. What we offer: Genuinely meaningful work as part of the most successful alliance in history; 5 year contract with competitive tax-free salary and household and children’s allowances; Privileges for expatriate staff including expatriation and education allowances (where appropriate) and additional home leave; Excellent private health insurance scheme; Generous annual leave of 30 days plus official holidays; NATO Pension Scheme; Development programs such as professional training, wellbeing, and more. To learn more about NCIA and our work, please visit our website. The NCIA prides itself on being an equal opportunity employer. We are committed to fostering an inclusive environment of mutual respect and value uniqueness and differences in gender, gender identity, race, ethnic or cultural origin, age, religion, sexual orientation and physical or neurocognitive ability. Additional details on the conditions of application can be found here via the NCIA career site.

Responsibilities

The Senior Cyber Security Defender will provide technical and expert support for the 24/7 Cyber Security Incident Response Team processes, including on-call duties, and will be responsible for conducting threat hunting campaigns and maintaining analysis tools.