A security operations centre can only detect what it can see. You would own what it sees with.

A multinational defence organisation in Mons needs one person to properly own its security monitoring, traffic aggregation and packet capture platforms across many networks, sites and data centres.

What you would be doing

• Running the network visibility and security monitoring capability the operations centre depends on
• Owning the full lifecycle of these platforms: deployment, upgrades, obsolescence and decommissioning
• Tuning monitoring, aggregation and packet capture so the collected data is complete and useful
• Watching platform health, data quality, retention and storage, and closing visibility gaps
• Troubleshooting Linux, network and data collection problems across the monitoring estate
• Working with analysts and detection engineers so coverage keeps up with what they need to find
• Capacity planning, audit support, site surveys and taking part in cyber defence exercises

What you would bring

• Expert knowledge of network security monitoring and cyber defence operations
• Hands-on experience with large, distributed monitoring across many sites or data centres
• Enterprise work with tools such as Firepower, Corelight and NetWitness
• Strong network visibility, packet broker and packet capture experience
• Linux and network troubleshooting down to packet flow and interfaces
• A cyber security certification such as CISM, CISSP or GIAC
• A relevant degree with two years of experience, or six years of progressive experience instead
• Fluent professional English

Why this one is worth a look

If you know the difference between a dashboard that is green and a capture that is actually complete, this one is for you.