CDSA Senior Engineer
Request: C005299
Location: Mons, Belgium
Work arrangement: Full-time on-site, with up to 20% remote work subject to approval
Security clearance: NATO Secret
Key duties
Under the direction of the DICE Team Lead, the contractor will:
- Design, develop, and maintain CDSA dashboards, visualizations, and user-interface components in Splunk.
- Build and optimize Splunk data models, KVStore collections, scheduled searches, macros, and related objects.
- Implement enhancements and defect fixes based on operational priorities and user feedback.
- Integrate new data sources and tools, such as PLM, ACPV, and Cribl.
- Develop automation and supporting scripts using Python, Bash, or similar technologies.
- Provide day-to-day technical and operational support to Cyber Operations Centre users.
- Serve as the technical bridge between CyOC users and the development contractor, Infigo/King ICT.
- Gather, prioritize, and translate operational feedback into clear technical requirements.
- Test and validate contractor deliverables before production deployment.
- Support Early Life Support activities for new features and releases.
- Monitor dashboard performance, data quality, and overall platform health.
- Improve dashboards, data pipelines, and platform functionality.
- Contribute to the CDSA platform’s technical roadmap and continued evolution.
Essential requirements
At least 3 years of practical, hands-on experience with:
- Splunk dashboard development
- Splunk data models, KVStore, macros, and scheduled searches
- Splunk user-interface development and visualization best practices
- Python, Bash, or comparable scripting languages
- REST APIs or similar interfaces
- Databases and database integration
The candidate must also have:
- A solid understanding of cybersecurity concepts, including vulnerability management, threat intelligence, and incident management.
- Proven ability to combine operational support with hands-on technical development.
- Strong analytical, troubleshooting, and problem-solving abilities.
- The ability to translate technical subjects for operational users and convert operational needs into technical solutions.
- Good communication skills and the ability to work directly with end users, contractors, and technical teams.
- English proficiency of at least NATO STANAG 6001 Level 3.
Education
- Bachelor’s degree from a recognized university in a related discipline, plus 3 years of relevant post-degree experience; or
- Without a degree, at least 10 years of extensive and progressively responsible relevant experience.
Desirable qualifications
- Splunk Enterprise certification.
- Machine Learning or Artificial Intelligence certification.
- Experience with CDSA or a similar large Splunk-based platform.
- Experience with data integration using REST APIs, DB Connect, Cribl, or comparable technologies.
- Knowledge of MITRE ATT&CK or vulnerability-scoring methodologies.
- Practical experience with Machine Learning or Artificial Intelligence.
- Previous work in NATO, military, governmental, or other high-security environments.
Working conditions
- Normal office environment in Mons.
- NCIA equipment will be provided for processing restricted information.
- For remote work involving public or unclassified information, the contractor must provide suitable IT equipment and be able to join video meetings through Microsoft collaboration tools.
- Up to 20% remote work from another NATO nation may be permitted with prior approval from the designated NCIA Resource Manager.
- Travel to other NCIA locations may be required for meetings.
- Individual trips will last no more than two days and occur no more than twice per month.
- Authorized travel will be reimbursed according to NATO regulations and must originate from the designated duty station.