Security Monitoring Platform Engineer

A NATO cyber security operations centre in Mons can only detect what it can see. Theplatforms that give it that visibility
- security monitoring, traffic aggregation and full packetcapture across many networks, sites and data centres
- need one person who owns them properly. Thatis this role. WHAT YOU WOULD BE DOING
* Delivering and maintaining the network visibility and security monitoring capability theoperations centre works from.
* Acting as the subject matter expert for the operation, configuration and lifecycle of securitymonitoring and packet capture technology.
* Managing that lifecycle end to end: deployment, configuration, maintenance, upgrades,obsolescence and decommissioning.
* Configuring and tuning monitoring, traffic aggregation and packet capture so the datacollection is reliable and the analysis is worth doing.
* Watching platform health, availability, data quality, retention, storage use andperformance.
* Finding and closing the visibility gaps that would otherwise blunt threat detection.
* Troubleshooting Linux, network, connectivity, performance and data collection problems acrossthe monitoring environment.
* Keeping the documentation real
- architecture diagrams, inventories, operating procedures,support information.
* Supporting the design of new monitoring solutions, and their integration with the wideranalytics and incident management tooling.
* Working with the security analysts and the detection engineers so monitoring coverage keeps upwith what they need to detect.
* Capacity planning and scalability assessment, and the compliance, audit and assurance work thatcomes with cyber defence technology.
* Supporting cabling, deployment planning and site surveys for monitoring and visibilityinfrastructure, and taking part in cyber defence exercises when they run. WHAT THEY ARE LOOKING FOR
* Expert knowledge of network security monitoring and cyber defence operations inan enterprise monitoring environment.
* Extensive hands on experience supporting large scale, distributed securitymonitoring across multiple networks, sites, segments or data centres.
* Enterprise-scale work with monitoring and traffic-capture tooling of the Firepower, Corelight and NetWitness kind.
* Strong hands on work with network visibility, traffic aggregation, packet brokers and packetcapture.
* Proven platform health and performance monitoring, capacity management, troubleshooting andoperational governance.
* A deep grasp of how enterprise networks are built and how traffic actually moves through them.
* Linux and network troubleshooting: connectivity, packet flow, interfaces, performance andsystem level diagnostics.
* Practical experience of cabling, site surveys and the physical side of deploying monitoringinfrastructure.
* Strong knowledge of security telemetry collection, event correlation, threat detection andthreat hunting.
* Fluent professional English.
* A relevant cyber security certification
- CISM, CISSP or GIAC Security.
* A bachelor's degree in a related discipline with two years of relevant experience;exceptionally, six years or more of progressive experience in the same work instead. ALSO VALUED
* Designing large scale security monitoring and network visibility architectures.
* Integrating monitoring tools with SIEM and SOAR platforms.
* Automation, scripting or orchestration.
* Major platform upgrades, migrations, refreshes and service transition.
* Previous work in an international environment with both military and civilian elements, and aworking knowledge of how NATO is organised. PRACTICAL DETAIL
* Fully on site in Mons, Belgium, in a normal office environment. Equipment isprovided for restricted information.
* 5 October to 30 December 2026, 400 hours in total.
* Occasional travel to other locations in support of operational duties, reimbursed under NATOtravel rules. Travel inside the duty country counts as commuting.
* You must hold a valid clearance and be a citizen of a NATO member country. If you have kept a sensor estate honest at scale
- and you know the difference between adashboard that is green and a capture that is actually complete
- this one is for you.