C005322 Second Line Security Event Analyst (NS) TUE 15 Sep

Deadline Date: Tuesday 15 September 2026

Requirement: Second Line Security Event Analyst

Location: Mons BE

Full Time On-Site: Yes

Time On-Site: 100%

Total Scope of the request (hours): 395

Required Start Date: 26 October 2026

End Contract Date: 31 December 2026

Required Security Clearance: NATO SECRET

Duties & Role:

Under the direction of the Team Lead and CSOC Section Head the contractor shall:

• Review and validate investigations supporting FirstLine Analysts to ensure that alert closures escalations supporting evidence and investigation notes meet CSOC quality standards confirming completeness accuracy and procedural compliance.
• Act as the technical escalation point for cybersecurity monitoring. Perform indepth log analysis and threattriage using the SIEM and SOAR platforms (Splunk Enterprise Security Splunk SOAR Microsoft Sentinel) together with supporting data sources and security appliances and decide whether to forward the case to IncidentHandling Officers.
• Provide oncall support as part of a 24 7 roster delivering roundtheclock coverage for secondline escalations.
• Design develop test and maintain detection rules alerts and analytics across the cybersecurity monitoring toolset.
• Continuously adjust logic thresholds allowlists suppression rules and severity mappings to reduce false positives and improve coverage of emerging threats.
• Provide regular constructive feedback and coaching to FirstLine Analysts on investigation techniques analytical approach and reporting quality and support the onboarding and training of new staff.
• Support the Duty SecondLine Analyst with weekly operational responsibilities monitor open tasks follow up on pending actions and highlight issues that could affect CSOC service continuity.
• Participate in purple teaming events within NCSC in order to test and improve CSOCs detection coverage.
• Collaborate with Threat Hunting Team (CTIS) to operationalize their findings into automated detections where applicable.
• Contribute to continuousserviceimprovement initiatives by identifying workflow inefficiencies monitoring blindspots and recommending process enhancements.
• Write and update operational documentation SOPs runbooks and knowledgebase articles that underpin Service Delivery Management (SDM) and the wider CSOC team.
• Represent the CSOC during project planning implementation and transition activities ensuring that monitoring and visibility requirements are fully considered and offer expertise on detectioncontent design logsource integration and securitytool configuration for any cybersecurity projects undertaken by the organisation.
• Collaborate with internal and external stakeholders working closely with other Defendbranch sections and when required the wider NCI Agency.
• Perform other duties as required including adhoc projects special investigations or support activities that fall outside the listed responsibilities to ensure the overall effectiveness and resilience of the CSOC.

Specific Working Conditions: If working from a remote location the contractor shall provide IT equipment for the processing of public and unclassified information in support of their duties including the capability to participate in video meetings using Microsoft based collaboration tools.

Travel required: The contractor may be required to travel to NCIA locations in support of operational such cases the contractor will be reimbursed for travel costs according to NATO regulations for traveling on NATO duty. Contractors traveling for work purposes shall initiate travel requests from their designated duty station only.

Skills Knowledge & Experience:

• The candidate must have a currently active NATO SECRET security clearance
• A minimum requirement of a Bachelors degree from a nationally recognised/certified university in a related discipline and three years postrelated experience. Alternatively the lack of a university degree may be compensated by the demonstration of a candidates particular abilities or experience of interest to the NCI Agency provided the candidate has at least five years of extensive and progressive expertise in duties related to the function of the post.
• Minimum three years of hands-on experience in a Security Operations Centre (SOC CSOC GSOC or equivalent) or a closely related cyber monitoring environment.
• Proven expertlevel track record of conducting indepth analysis of complex cybersecurity incidents and producing clear authoritative reports and recommendations for supporting teams and external partners.
• Adept at extracting normalising and interrogating raw log data from diverse sources (e.g. Windows Event Logs Linux syslog Sysmon EDR/XDR platforms such as Microsoft Defender Sentinel One or CrowdStrike) using SIEM and query tools (Splunk Microsoft Sentinel Elastic Kibana). Able to filter correlate and visualise events to verify alerts reconstruct attacker activity across hosts and provide actionable evidence for escalation and remediation decision
• Hands-on packet-capture (PCAP) analysis experience extracting filtering and interpreting network traffic with tools such as Wireshark tcpdump or Zeek to corroborate alerts reconstruct attack timelines and support escalation decisions.
• Demonstrable ability to translate attacker TTPs and threat intel into operational detection logic and to conduct structured quality or peer reviews of analyst investigations identifying gaps and recommending improvements.
• Experience in designing developing and maintaining detection rules alerts and analytics across SIEM EDR/XDR and cloud security tools (e.g. Splunk Microsoft Sentinel Azure AWS).
• Experience supporting or mentoring less-experienced analysts providing constructive feedback on investigation quality and reporting standards.
• Practical experience with automation or SOAR use cases identifying repetitive manual tasks and creating enrichment or workflow improvements.
• Strong written and verbal communication skills with a history of producing clear investigation notes escalation summaries and documentation.
• Very good communication and analytical skills.
• Language proficiency in English: meet or exceed the NATO STANAG 6001 Level 3 Professional Proficiency.
• Relevant cybersecurity certifications (e.g. CISSP CISM GIACcertified credentials such as GCIH GCFA or GSEC; CompTIA CySA) or equivalent recognised professional training.

Desirable

• A university degree (Bachelors) in Cyber Security Information Technology Computer Science or a related discipline.
• Experience working in a regulated high control environment such as defence government financial services or other enterprise sectors.
• Hands on experience with cloud native security monitoring (Azure AWS) and hybrid environments.
• Experience with developing detections from network and edge security devices such as Cisco Fortinet/Fortigate Palo Alto or comparable appliances.
• Experience in working for or supporting a military or governmental organization.

Required Experience:

IC