Threat Hunter

Spektrum have a wide range of exciting opportunities in several global locations.

We are always looking to add great new talent to our team and look forward to hearing from you.

**Whom we are supporting**

The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium.

The NCIA provides a wide range of services, including:

- Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats.
- Command and Control Systems: The NCIA develops and maintains the systems that NATO's military commanders use to plan and execute operations.
- Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
- Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks.

Overall, the NCIA is critical in ensuring the security and effectiveness of NATO's communication and information technology capabilities.

**The program**

**Assistance and Advisory Service (AAS)**

The NATO Communications and Information Agency (NCI Agency) is NATO's principal C3 capability deliverer and CIS service provider. It provides, maintains, and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV and, when required, stand together in the face of attack under Article V.

To provide these critical services in the modern, evolving, dynamic environment, the NCI Agency must build and maintain a high-performance-engaged workforce. The NCI Agency workforce strategically consists of three major categories: NATO International Civilians (NIC)s, Military (Mil), and Interim Workforce Consultants (IWC)s. The IWCs are a critical part of the overall NCI Agency workforce and comprise approximately 15 percent of the workforce.

**Specific Working Conditions**:Normal office environment with standard working hours. Exceptionally may be required to work outside of normal working hours or on a shift system for a limited period due to urgent operational needs such as support of delivery of critical services, major cyber incidents and other emergency scenarios

**Duties and Role**:

- Provide advice and technical assistance to other stakeholders, maintain technical expertise, awareness, and developments in related new technologies, and provide technical contributions to any projects related to the data security systems
- Be responsible for management and further development of the data security systems.
- Following ITIL standards, provide support to Operations and Service Delivery management covering all stages of the data security systems lifecycle (e.g. Service Design, Transition, Operations, Change Management and Continual Service Improvement).
- Ensure that all system components are continuously monitored and take appropriate technical and non-technical actions for solving detected issues.
- Ensure that data security systems operate within any KPI's, as defined in Service Level Agreements with NCSC customers.
- Support integration with external tools and any associated activities.
- Proactively identify and propose system improvements to ensure an up-to-date and stable environment. Justify business needs, prepare documentation and implementation plan for the Change Management Board. Implement the approved changes following co-ordination with other stakeholders.
- Coordinate with service delivery managers, end users and other stakeholders in support of related services; communicate with other NATO entities as well as industry partners where required.
- Develop and maintain documentation guidelines, standard operating procedures, system and service design documents and other relevant documentation that support management of the data security systems.
- Create technical and/or executive level reports as required; organise and deliver presentations and briefings for various audience up to NATO executive level.

**Requirements**:
**Skill, Knowledge & Experience**:

- At least 1 year of experience using/administering Splunk Enterprise
- At least 2 years of extensive practical experience as a tool engineer/system administrator in large enterprise environments (deployment, installation, configuration and maintenance), especially Linux environments
- Practical skills in writing Bash, Python or Ansible scripts to support repetitive tasks automation.
- Solid understanding of regular expressions.
- Familiarity with Sysmon and its concepts.
- Familiarity with the concepts of Tactics, Techniques, Procedures (from an ATT&CK point of view).
- Ability to develop clear and concise technical documentation, including procedures.
- D