[6301] CDSA Senior Engineer

ppStart date: Negotiable /ppClearance: NATO Secret/EU Secret (equivalent) /ppLocation: Mons, Belgium /ph3Duties Role: /h3pWe are looking for a hands‑on Senior Cyber Security Engineer to support the Cyber Defence Situational Awareness (CDSA) platform. /ppThe role combines technical development work (mainly in Splunk) with operational support and close coordination with both the development contractor and CyOC users. The role requires strong ownership, the ability to translate operational requirements into technical solutions, and a proactive approach to improving the platform. /ph3Under the direction of the DICE Team Lead the contractor shall: /h3h3Technical Development Maintenance /h3ulliDesign, develop and maintain CDSA dashboards, visualizations, and user interface components in Splunk. /liliBuild and optimize data models, KVStore collections, scheduled searches, macros and related Splunk objects. /liliImplement enhancements and defect fixes based on operational priorities and user feedback. /liliSupport the integration of new data sources and tools into CDSA (e.g. PLM, ACPV, Cribl, etc.). /liliDevelop automation and supporting scripts (Python, Bash or similar). /li /ulh3Operational Support CyOC Coordination /h3ulliProvide day‑to‑day technical and operational support to Cyber Operations Centre (CyOC) users. /liliAct as a technical bridge between CyOC operational needs and the development contractor (Infigo/King ICT). /liliGather, prioritize and translate user feedback into clear technical requirements. /liliValidate and test contractor deliverables before production deployment. /liliSupport Early Life Support (ELS) activities for new features and releases. /li /ulh3Platform Health Continuous Improvement /h3ulliMonitor dashboard performance, data quality, and overall platform health. /liliIdentify and drive improvements to existing dashboards, data pipelines and platform functionality. /liliContribute to the technical roadmap and evolution of the CDSA platform. /li /ulpSpecific Working

Conditions:
If working from a remote location, the contractor shall provide IT equipment for the processing of public and unclassified information in support of their duties, including the capability to participate in video meetings using Microsoft based collaboration tools. /ppThe contractor may be permitted to perform work remotely, from a different NATO nation than the duty location, for up to a maximum of twenty percent (20%) of their total working time, subject to prior approval by their NCIA designated Resource Manager. /ppThe contractor may be required to travel to other NCIA locations for in‑person or department meetings. In such cases the contractor will be reimbursed for travel costs according to NATO regulations for traveling on NATO duty. Each travel will be a maximum of 2 days lengths and happening no more than twice per month. Contractors traveling for work purposes shall initiate travel requests from their designated duty station only. /ph3Skills, Knowledge

Experience:
/h3ulliAt least 3 years practical and hands‑on experience in Splunk (dashboard development, data models, KVStore, macros, scheduled searches). /liliAt least 3 years practical and hands‑on experience in Splunk UI development and visualization best practices. /liliAt least 3 years practical and hands‑on experience in scripting (Python, Bash, or similar). /liliAt least 3 years practical and hands‑on experience in interacting with REST APIs or similar /liliAt least 3 years practical and hands‑on experience in interacting with Databases /liliSolid understanding of cybersecurity concepts (vulnerability management, threat intelligence, incident management). /liliProven ability to balance operational support with hands‑on development /liliGood communication and analytical skills — able to translate technical topics for operational users and vice versa. /li /ulh3Education, Experience and Training (Desirable): /h3ulliPrevious experience with CDSA or similar large Splunk‑based platforms. /liliExperience with data integration projects (REST APIs, DB Connect, Cribl, etc.). /liliKnowledge of MITRE ATTCK or vulnerability scoring methodologies. /liliPrior experience with Machine Learning and Artificial Intelligence /liliPrevious work in NATO, military, or high-security environments. /liliCertification in Splunk Enterprise /liliCertification in Machine Learning and/or Artificial Intelligence /li /ul /p