Threat Detection Specialist — MITRE ATT&CK Coverage for NATO with security clearance
Enregistrez cette offre et organisez votre recherche
Créez un compte gratuit pour enregistrer des offres d'emploi, créer des alertes et revenir à cette liste depuis votre tableau de bord.
A multinational defence organisation is strengthening the detection engineering side of its security operations centre. This is not alert triage: you build the content the analysts depend on, measure whether it works, and close the gaps you find.
What you would be doing
- Designing, building and maintaining detection rules, alerts and analytics across SIEM, EDR and XDR, network detection and cloud security tooling.
- Writing detection logic in the languages that suit it — Sigma, SPL, KQL.
- Building detections around adversary behaviour and mapping them to the MITRE ATT&CK framework, with advanced persistent threats in mind.
- Turning threat intelligence and purple team findings into working automated detections.
- Running a proper detection lifecycle — design, development, testing, deployment, monitoring, improvement, review — and improving the quality metrics behind it.
- Assessing detection coverage across on-premise and cloud estates, and doing the gap analysis that says where to invest next.
- Reviewing newly ingested log sources against the common information model, auditing field extractions and event mappings, and chasing data owners when something does not line up.
- Supporting incident handlers and threat hunters when an investigation is live.
What you would bring
- Real detection engineering experience, and the version control and code review habits that make it repeatable.
- Hands-on work with a major SIEM and with endpoint and network detection tooling.
- Fluency in at least one detection language, and enough scripting to automate the rest.
- Familiarity with adversary tradecraft and with the ATT&CK framework as a working tool rather than a poster.
- Professional English, and the ability to explain a detection decision to people who did not write it.
The assignment is on-site near Mons.
-
Mons, Walloon Region, Belgique WLG Temps pleinA multinational defence organisation is strengthening the detection engineering side of its security operations centre. This is not alert triage: you build the content the analysts depend on, measure whether it works, and close the gaps you find. What you would be doing Designing, building and maintaining detection rules, alerts and analytics across...
-
Incident Response Specialist
Il y a 1 jour
Mons, Walloon Region, Belgique WLG Temps pleinWhen something gets in, somebody has to be the one who stays calm and works the problem. That is this job. You would join the incident response team of a multinational defence organisation in Mons, Belgium, under the section head — responding to security incidents around the clock, and helping the wider alliance and its partners do the same. What you would...
-
CSIRT Analyst
Il y a 7 heures
Mons, Walloon Region, Belgique WLG Temps pleinWhen something gets in, somebody has to be the one who stays calm and works the problem. That is this job. You would join the incident response team of a multinational defence organisation in Mons, Belgium, under the section head — responding to security incidents around the clock, and helping the wider alliance and its partners do the same. What you would...
-
Mons, Walloon Region, Belgique WLG Temps pleinA NATO cyber security operations centre in Mons can only detect what it can see. The platforms that give it that visibility - security monitoring, traffic aggregation and full packet capture across many networks, sites and data centres - need one person who owns them properly. That is this role. What you would be doing Delivering and maintaining the network...
-
Mons, Walloon Region, Belgique WLG Temps pleinA multinational defence organisation is strengthening the detection engineering side of its security operations centre. This is not alert triage: you build the content the analysts depend on, measure whether it works, and close the gaps you find. What you would be doing Designing, building and maintaining detection rules, alerts and analytics across...
-
Mons, Walloon Region, Belgique WLG Temps pleinThis is a hands-on senior engineering post on a cyber defence monitoring platform, and it has two halves that most roles keep apart. One is development, largely in Splunk: dashboards, data models, searches, automation. The other is operational — supporting the operational team that uses it every day and translating what they need into something...
-
Security Monitoring Platform Engineer
Il y a 20 heures
Mons, Walloon Region, Belgique WLG Temps pleinA NATO cyber security operations centre in Mons can only detect what it can see. The platforms that give it that visibility - security monitoring, traffic aggregation and full packet capture across many networks, sites and data centres - need one person who owns them properly. That is this role. What you would be doing Delivering and maintaining the network...
-
Cyber Incident Responder
Il y a 3 heures
Mons, Walloon Region, Belgique WLG Temps pleinWhen something gets in, somebody has to be the one who stays calm and works the problem. That is this job. You would join the incident response team of a multinational defence organisation in Mons, Belgium, under the section head — responding to security incidents around the clock, and helping the wider alliance and its partners do the same. What you would...
-
Mons, Walloon Region, Belgique WLG Temps pleinThis is a hands-on senior engineering post on a cyber defence monitoring platform, and it has two halves that most roles keep apart. One is development, largely in Splunk: dashboards, data models, searches, automation. The other is operational — supporting the operational team that uses it every day and translating what they need into something buildable....
-
Network Visibility and Packet Capture Specialist
Il y a 20 heures
Mons, Walloon Region, Belgique WLG Temps pleinA NATO cyber security operations centre in Mons can only detect what it can see. The platforms that give it that visibility - security monitoring, traffic aggregation and full packet capture across many networks, sites and data centres - need one person who owns them properly. That is this role. What you would be doing Delivering and maintaining the network...
