Job Description

A NATO cyber security operations centre in Mons can only detect what it can see. The
platforms that give it that visibility - security monitoring, traffic aggregation and full packet
capture across many networks, sites and data centres - need one person who owns them properly. That
is this role.

What you would be doing

• Delivering and maintaining the network visibility and security monitoring capability the
  operations centre works from.
• Acting as the subject matter expert for the operation, configuration and lifecycle of security
  monitoring and packet capture technology.
• Managing that lifecycle end to end: deployment, configuration, maintenance, upgrades,
  obsolescence and decommissioning.
• Configuring and tuning monitoring, traffic aggregation and packet capture so the data
  collection is reliable and the analysis is worth doing.
• Watching platform health, availability, data quality, retention, storage use and
  performance.
• Finding and closing the visibility gaps that would otherwise blunt threat detection.
• Troubleshooting Linux, network, connectivity, performance and data collection problems across
  the monitoring environment.
• Keeping the documentation real - architecture diagrams, inventories, operating procedures,
  support information.
• Supporting the design of new monitoring solutions, and their integration with the wider
  analytics and incident management tooling.
• Working with the security analysts and the detection engineers so monitoring coverage keeps up
  with what they need to detect.
• Capacity planning and scalability assessment, and the compliance, audit and assurance work that
  comes with cyber defence technology.
• Supporting cabling, deployment planning and site surveys for monitoring and visibility
  infrastructure, and taking part in cyber defence exercises when they run.

What they are looking for

• Expert knowledge of network security monitoring and cyber defence operations in
  an enterprise monitoring environment.
• Extensive hands on experience supporting large scale, distributed security
  monitoring across multiple networks, sites, segments or data centres.
• Enterprise experience with security monitoring and packet capture platforms such as Cisco Firepower, Corelight and NetWitness
• Strong hands on work with network visibility, traffic aggregation, packet brokers and packet
  capture.
• Proven platform health and performance monitoring, capacity management, troubleshooting and
  operational governance.
• An advanced understanding of enterprise networking - concepts, protocols, architectures and
  data flows.
• Linux and network troubleshooting: connectivity, packet flow, interfaces, performance and
  system level diagnostics.
• Practical experience of cabling, site surveys and the physical side of deploying monitoring
  infrastructure.
• Strong knowledge of security telemetry collection, event correlation, threat detection and
  threat hunting.
• English at NATO STANAG 6001 level 3, professional proficiency.
• A relevant cyber security certification - CISM, CISSP or GIAC Security.
• A bachelor's degree in a related discipline with two years of relevant experience;
  exceptionally, six years or more of progressive experience in the same work instead.

Also valued

• Designing large scale security monitoring and network visibility architectures.
• Integrating monitoring tools with SIEM and SOAR platforms.
• Automation, scripting or orchestration.
• Major platform upgrades, migrations, refreshes and service transition.
• Previous work in an international environment with both military and civilian elements, and a
  working knowledge of how NATO is organised.

Practical detail

• Fully on site in Mons, Belgium, in a normal office environment. Equipment is
  provided for restricted information.
• 5 October to 30 December 2026, 400 hours in total.
• Occasional travel to other locations in support of operational duties, reimbursed under NATO
  travel rules. Travel inside the duty country counts as commuting.
• You must hold a valid clearance and be a citizen of a NATO member country.

If you have kept a sensor estate honest at scale - and you know the difference between a
dashboard that is green and a capture that is actually complete - this one is for you.