First Line Security Event Analyst (FLSEA) 6

NCIM is looking for a First Line Security Event Analyst (FLSEA) to work within the NATO Cyber Security Centre (NCSC) team in Mons, Belgium. The analyst will perform initial analysis of logs and network traffic, determine alert severity and escalate when required. They will collate information and present findings in a clear, structured format, providing remediation recommendations and first line response where applicable. Duties include conducting research and assessments of security events, providing analysis of firewall, IDS, anti-virus and other network sensor produced events, leveraging the comprehensive extended toolset (e.g.

Log Collection, Intrusion Detection, Packet Capture, VA, Network Devices) for enhancing investigations, supporting the end-to-end Incident Handling process, and proposing optimisations and enhancements to maintain and improve NATO's Cyber Security posture.

Requirements: a university degree in a technical subject with a focus on Information Technology (IT) plus a minimum of 1 year experience in cyber security analysis; lack of degree may be compensated by at least 3 years relevant experience, or by demonstrating a high level of knowledge in cybersecurity.

Also required: comprehensive knowledge of computer and communications security including TCP/IP networking, Windows and Linux; broad understanding of common network security threats and mitigation techniques; experience with SIEM products (e.g. ArcSight, Splunk); analysis of NIDS events (e.g. SourceFire, Palo Alto); log analysis from various sources (Firewalls, Proxies, Routers, DNS, security appliances); network traffic capture analysis using Wireshark; logical approach to analysis and ability to perform structured security investigations using large, complex data sets; good written and spoken communication skills; ability to work independently and as part of a team.

Preferences include industry leading certifications (GCIA, GNFA, GCIH), CIRT/CERT experience, proficiency in Intrusion/Incident Detection and Handling, Full Packet Capture systems (Niksun, RSA/NetWitness), Host Based Intrusion Detection Systems, computer security tools (Vulnerability Assessment, Anti-virus, Protocol Analysis, Anti-Spyware), computer forensics tools, and military communication systems and networks.