[6353] Senior Cyber Security Specialist

Start date: Negotiable
Clearance: NATO Secret
Location: Mons, Belgium

Duties & Role:
• Under the direction of the Section Head of Cyber Enablement Service (CES) the contractor shall:
• Support the development, refinement and management of technical and operational requirements for cyber and CIS monitoring capabilities;
• Engage with NATO stakeholders, customers, users, technical authorities and operational representatives to solicit, analyse and document technical requirements;
• Translate operational needs into clear engineering requirements, system requirements, functional requirements and non-functional requirements;
• Develop and maintain engineering artefacts, including but not limited to: Requirements specifications; Use cases; User stories and operational scenarios; State diagrams; Workflow diagrams / WFDs; System context diagrams; Interface descriptions; Capability and service descriptions; Conceptual and logical architecture products; Testable acceptance criteria;
• Support the development of CIS capability designs, including hardware, software, network and security architecture considerations;
• Provide technical input on cyber monitoring technologies, including network monitoring, security monitoring, packet capture, sensor platforms, logging, telemetry collection, detection engineering, analytics platforms and supporting infrastructure;
• Support the identification, analysis and documentation of hardware requirements for CIS capabilities, including appliances, sensors, servers, storage, network taps, aggregation devices, packet brokers, virtualised infrastructure and supporting network components;
• Support the development of capability roadmaps, technical options papers, decision briefs and engineering recommendations;
• Support stakeholder management activities, including planning and facilitating technical workshops, requirements sessions, design reviews and coordination meetings;
• Work with customers and operational users to ensure that requirements are complete, realistic, technically feasible and aligned with NATO operational needs;
• Support the preparation of acquisition and procurement documentation, including Invitations for Bid, statements of work, technical specifications, evaluation criteria and clarification responses;
• Translate NATO technical and operational needs into language that can be understood by industry while preserving the required capability outcomes;
• Support purple team activities to validate monitoring capability effectiveness, including collaboration with red team, blue team, detection engineering and operational cyber defence stakeholders;
• Assist in identifying visibility gaps, detection opportunities and monitoring improvements based on adversary emulation, attack scenarios and operational use cases;
• Provide technical advice on cyber security architecture, monitoring architecture, system integration, tool configuration and operational improvements;
• Coordinate with project managers, system engineers, network engineers, security architects, operational teams, industry representatives and other stakeholders to ensure successful delivery of cyber capabilities;
• Support handover to operations, including knowledge transfer, training support and preparation of operational documentation;
• Participate in technical meetings, reviews, workshops and coordination activities with NATO, national and industry stakeholders;

Requirements:
• The candidate must have a currently active NATO SECRET security clearance
• A minimum requirement of a Bachelor's degree at a nationally recognised/certified University in a related discipline and 3 years post-related experience;
• Or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience that is/are of interest to NCIA, that is, at least 10 years extensive and progressive expertise in duties related to those in this Statement of Work.
• At least 5 years of practical experience in cyber security, systems engineering, CIS engineering, capability development or a related technical field;
• Strong engineering experience across the capability lifecycle, from requirements development through design, integration, testing, validation, acceptance and transition to operations;
• Proven experience developing technical requirements, system specifications, use cases, state diagrams, workflow diagrams, operational scenarios and other engineering artefacts;
• Demonstrated experience working with customers and stakeholders to solicit, analyse, prioritise and document technical and operational requirements;
• Experience supporting or developing procurement documentation, including Invitations for Bid, statements of work, technical specifications, compliance matrices and technical evaluation criteria;
• Proven ability to translate complex customer needs and operational requirements into clear, structured and industry-understandable technical documentation;
• Strong background in cyber security, including familiarity with cyber defence operations, monitoring concepts, detection capabilities and security operations environments;
• Strong understanding of CIS monitoring capabilities, including the deployment and integration of monitoring tools, sensors, appliances, network capture platforms, log collection, telemetry, analytics and supporting infrastructure;
• Strong hardware background relevant to CIS and cyber monitoring environments, including servers, storage, network devices, security appliances, packet capture systems, taps, aggregation devices and associated infrastructure;
• Working knowledge of routing, switching, network segmentation, firewalls, virtualisation and enterprise infrastructure;
• Experience with problem analysis and resolution in complex systems and services, including the development and implementation of corrective or preventative measures;
• Experience coordinating technical work with project managers, engineers, security architects, operational users and industry teams;
• Practical experience with cyber security tools, monitoring platforms, SIEM or security analytics technologies is highly desirable;
• Experience with purple team activities, including adversary emulation, detection validation, cyber exercise support, collaboration between offensive and defensive teams, or validation of monitoring effectiveness;
• Experience in the delivery of technologies, systems, solutions or capabilities for industry, government, defence or military organisations;
• Experience with implementation projects within NATO and/or national military organisations is desirable;
• Experience supporting deployment or operation of technical capabilities in operational military environments is desirable;
• Ability to work independently and as part of a team to achieve agreed objectives;
• Ability to monitor, coordinate and support work performed by industry teams;
• Excellent communication and technical writing skills in English.
• Very good communication and analytical skills.
• Language proficiency in English: meet or exceed the NATO STANAG 6001 Level 3 "Professional Proficiency".

Desirable Experience:
• Experience in working for or supporting a military or governmental organization.

Specific Working Conditions:
The contractor may be permitted to perform work remotely, from a different NATO nation than the duty location, for up to a maximum of twenty percent (20%) of their total working time, subject to prior approval by their Resource Manager (to which they will be assigned upon contract start) and the NCSC Accreditation Support Lead.
The contractor may work from their home in the duty location subject to the NCIA teleworking policy and in coordination with the NCSC Accreditation Support Lead.
Travel required: The contractor may be required to travel to NCIA locations in Belgium for in-person or department meetings. In such cases the contractor will be reimbursed for travel costs according to NATO regulations for traveling on NATO duty. Travel will be required to other NATO and mission-led locations. Contractors traveling for work purposes shall initiate travel requests from their designated duty station only.