JobCubby JobCubby
Sign up
WLG

Security Monitoring Platform Engineer (Corelight, NetWitness, Firepower) for NATO with security clearance

WLG Mons, Wallonia, Belgium

Financial Services · 2-10 employees

3 h ago
Senior (5-10 yrs) Full-time Belgium
Log in to apply, save this posting, or score it against your profile with AI.

About the role

The role involves owning, maintaining, and configuring the network visibility and security monitoring platforms for a NATO cyber security operations centre. You will manage the full lifecycle of these technologies, including deployment, troubleshooting, and ensuring reliable data collection for threat detection.

What they look for

Network security monitoring Cyber defence Cisco Firepower Corelight NetWitness Packet capture Traffic aggregation Linux Network troubleshooting Security telemetry Event correlation Threat detection Threat hunting Capacity planning Infrastructure deployment

Requirements

Candidates must have extensive experience in large-scale security monitoring, network visibility, and packet capture platforms like Corelight, NetWitness, and Cisco Firepower. A bachelor's degree in a related field, a relevant cyber security certification (CISM, CISSP, or GIAC), and a valid security clearance are required.

Full description

A NATO cyber security operations centre in Mons can only detect what it can see. Theplatforms that give it that visibility - security monitoring, traffic aggregation and full packetcapture across many networks, sites and data centres - need one person who owns them properly. Thatis this role.

What you would be doing

  • Delivering and maintaining the network visibility and security monitoring capability theoperations centre works from.
  • Acting as the subject matter expert for the operation, configuration and lifecycle of securitymonitoring and packet capture technology.
  • Managing that lifecycle end to end: deployment, configuration, maintenance, upgrades,obsolescence and decommissioning.
  • Configuring and tuning monitoring, traffic aggregation and packet capture so the datacollection is reliable and the analysis is worth doing.
  • Watching platform health, availability, data quality, retention, storage use andperformance.
  • Finding and closing the visibility gaps that would otherwise blunt threat detection.
  • Troubleshooting Linux, network, connectivity, performance and data collection problems acrossthe monitoring environment.
  • Keeping the documentation real - architecture diagrams, inventories, operating procedures,support information.
  • Supporting the design of new monitoring solutions, and their integration with the wideranalytics and incident management tooling.
  • Working with the security analysts and the detection engineers so monitoring coverage keeps upwith what they need to detect.
  • Capacity planning and scalability assessment, and the compliance, audit and assurance work thatcomes with cyber defence technology.
  • Supporting cabling, deployment planning and site surveys for monitoring and visibilityinfrastructure, and taking part in cyber defence exercises when they run.

What they are looking for

  • Expert knowledge of network security monitoring and cyber defence operations inan enterprise monitoring environment.
  • Extensive hands on experience supporting large scale, distributed securitymonitoring across multiple networks, sites, segments or data centres.
  • Enterprise experience with security monitoring and packet capture platforms such asCisco Firepower, Corelight and NetWitness.
  • Strong hands on work with network visibility, traffic aggregation, packet brokers and packetcapture.
  • Proven platform health and performance monitoring, capacity management, troubleshooting andoperational governance.
  • An advanced understanding of enterprise networking - concepts, protocols, architectures anddata flows.
  • Linux and network troubleshooting: connectivity, packet flow, interfaces, performance andsystem level diagnostics.
  • Practical experience of cabling, site surveys and the physical side of deploying monitoringinfrastructure.
  • Strong knowledge of security telemetry collection, event correlation, threat detection andthreat hunting.
  • English at NATO STANAG 6001 level 3, professional proficiency.
  • A relevant cyber security certification - CISM, CISSP or GIAC Security.
  • A bachelor's degree in a related discipline with two years of relevant experience;exceptionally, six years or more of progressive experience in the same work instead.

Also valued

  • Designing large scale security monitoring and network visibility architectures.
  • Integrating monitoring tools with SIEM and SOAR platforms.
  • Automation, scripting or orchestration.
  • Major platform upgrades, migrations, refreshes and service transition.
  • Previous work in an international environment with both military and civilian elements, and aworking knowledge of how NATO is organised.

Practical detail

  • Fully on site in Mons, Belgium, in a normal office environment. Equipment isprovided for restricted information.
  • 5 October to 30 December 2026, 400 hours in total.
  • Occasional travel to other locations in support of operational duties, reimbursed under NATOtravel rules. Travel inside the duty country counts as commuting.
  • You must hold a valid clearance and be a citizen of a NATO member country.

If you have kept a sensor estate honest at scale - and you know the difference between adashboard that is green and a capture that is actually complete - this one is for you.