Senior Splunk Engineer at Spektrum Group in Mons, Belgium

Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.

---

Who we are supporting

The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium.

The NCIA provides a wide range of services, including:

• Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats.
• Command and Control Systems: The NCIA develops and maintains the systems used by NATO's military commanders to plan and execute operations.
• Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
• Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks.
• Information Management: The NCIA manages NATO's information technology infrastructure, including its databases, applications, and servers.

Overall, the NCIA plays a critical role in ensuring the security and effectiveness of NATO's communication and information technology capabilities.

The program

Assistance and Advisory Service (AAS)

The NATO Communications and Information Agency (NCI Agency) is NATO’s principal C3 capability deliverer and CIS service provider. It provides, maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV, and, when required, stand together in the face of attack under Article V.

To provide these critical services, in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorise's: NATO International Civilians (NIC)'s, Military (Mil), and Interim Workforce Consultants (IWC)'s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce.

---

Role ID – C005299

Role Duties and Responsibilities

Senior Cyber Security Engineer to support the Cyber Defence Situational Awareness (CDSA) platform.

The role combines technical development work (mainly in Splunk) with operational support and close coordination with both the development contractor and CyOC users. The role requires strong ownership, the ability to translate operational requirements into technical solutions, and a proactive approach to improving the platform. Under the direction of the DICE Team Lead the contractor shall:

Technical Development & Maintenance

• Design, develop and maintain CDSA dashboards, visualizations, and user interface components in Splunk.
• Build and optimize data models, KVStore collections, scheduled searches, macros and related Splunk objects.
• Implement enhancements and defect fixes based on operational priorities and user feedback.
• Support the integration of new data sources and tools into CDSA (e.g. PLM, ACPV, Cribl, etc.).
• Develop automation and supporting scripts (Python, Bash or similar).

Operational Support & CyOC Coordination

• Provide day-to-day technical and operational support to Cyber Operations Centre (CyOC) users.
• Act as a technical bridge between CyOC operational needs and the development contractor (Infigo/King ICT).
• Gather, prioritize and translate user feedback into clear technical requirements.
• Validate and test contractor deliverables before production deployment.
• Support Early Life Support (ELS) activities for new features and releases.

Platform Health & Continuous Improvement

• Monitor dashboard performance, data quality, and overall platform health.
• Identify and drive improvements to existing dashboards, data pipelines and platform functionality.
• Contribute to the technical roadmap and evolution of the CDSA platform.

Essential Skills, Experience and Certifications

• At least 3 years practical and hands-on experience in:
  • Splunk (dashboard development, data models, KVStore, macros, scheduled searches).
  • Splunk UI development and visualization best practices.
  • scripting (Python, Bash, or similar).
  • Interacting with REST APIs or similar
  • Interacting with Databases
• Solid understanding of cybersecurity concepts (vulnerability management, threat intelligence, incident management).
• Proven ability to balance operational support with hands-on development

Skills:

• Good communication and analytical skills — able to translate technical topics for operational users and vice versa.
• Strong analytical and problem-solving skills.
• Ability to work operationally with end users while also performing technical development work.

Desirable Skills, Experience and Certifications

• certification in Splunk Enterprise
• certification in Machine Learning and/or Artificial Intelligence
• Previous experience with CDSA or similar large Splunk-based platforms.
• Experience with data integration projects (REST APIs, DB Connect, Cribl, etc.).
• Knowledge of MITRE ATT&CK or vulnerability scoring methodologies.
• Prior experience with Machine Learning and Artificial Intelligence
• Previous work in NATO, military, or high-security environments.

Education

• A minimum requirement of a Bachelor's degree at a nationally recognised/certified University in a related discipline and 3 years post-related experience, or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience that is/are of interest to NCIA, that is, at least 10 years extensive and progressive expertise in duties related to those in this Statement of Work.

Language Proficiency

• Business English

Working Location

• Mons, Belgium

Working Policy

• Hybrid (80% on-site, 20% off-site)

Travel

• Some travel to other NATO sites may be required

Security Clearance

• Valid National or NATO Secret personal security clearance