CDSA Senior Engineer

Request: C005299
Location: Mons, Belgium
Work arrangement: Full-time on-site, with up to 20% remote work subject to approval
Security clearance: NATO Secret

Key duties

Under the direction of the DICE Team Lead, the contractor will:

• Design, develop, and maintain CDSA dashboards, visualizations, and user-interface components in Splunk.
• Build and optimize Splunk data models, KVStore collections, scheduled searches, macros, and related objects.
• Implement enhancements and defect fixes based on operational priorities and user feedback.
• Integrate new data sources and tools, such as PLM, ACPV, and Cribl.
• Develop automation and supporting scripts using Python, Bash, or similar technologies.
• Provide day-to-day technical and operational support to Cyber Operations Centre users.
• Serve as the technical bridge between CyOC users and the development contractor, Infigo/King ICT.
• Gather, prioritize, and translate operational feedback into clear technical requirements.
• Test and validate contractor deliverables before production deployment.
• Support Early Life Support activities for new features and releases.
• Monitor dashboard performance, data quality, and overall platform health.
• Improve dashboards, data pipelines, and platform functionality.
• Contribute to the CDSA platform’s technical roadmap and continued evolution.

Essential requirements

At least 3 years of practical, hands-on experience with:

• Splunk dashboard development
• Splunk data models, KVStore, macros, and scheduled searches
• Splunk user-interface development and visualization best practices
• Python, Bash, or comparable scripting languages
• REST APIs or similar interfaces
• Databases and database integration

The candidate must also have:

• A solid understanding of cybersecurity concepts, including vulnerability management, threat intelligence, and incident management.
• Proven ability to combine operational support with hands-on technical development.
• Strong analytical, troubleshooting, and problem-solving abilities.
• The ability to translate technical subjects for operational users and convert operational needs into technical solutions.
• Good communication skills and the ability to work directly with end users, contractors, and technical teams.
• English proficiency of at least NATO STANAG 6001 Level 3.

Education

• Bachelor’s degree from a recognized university in a related discipline, plus 3 years of relevant post-degree experience; or
• Without a degree, at least 10 years of extensive and progressively responsible relevant experience.

Desirable qualifications

• Splunk Enterprise certification.
• Machine Learning or Artificial Intelligence certification.
• Experience with CDSA or a similar large Splunk-based platform.
• Experience with data integration using REST APIs, DB Connect, Cribl, or comparable technologies.
• Knowledge of MITRE ATT&CK or vulnerability-scoring methodologies.
• Practical experience with Machine Learning or Artificial Intelligence.
• Previous work in NATO, military, governmental, or other high-security environments.

Working conditions

• Normal office environment in Mons.
• NCIA equipment will be provided for processing restricted information.
• For remote work involving public or unclassified information, the contractor must provide suitable IT equipment and be able to join video meetings through Microsoft collaboration tools.
• Up to 20% remote work from another NATO nation may be permitted with prior approval from the designated NCIA Resource Manager.
• Travel to other NCIA locations may be required for meetings.
• Individual trips will last no more than two days and occur no more than twice per month.
• Authorized travel will be reimbursed according to NATO regulations and must originate from the designated duty station.