Previously submitted bids have been found non-compliant for the following reasons: The application does not demonstrate “At least 2 years and expert level experience related to SIEM and Log collection management activities.” The application does not demonstrate “At least 1 year of extensive practical experience as SIEM administrator with Splunk in large enterprise environment (deployment, installation, configuration and maintenance).” The candidate was not able to demonstrate the expected level of proficiency with Linux during the interview "Missing: “At least 1 year of extensive practical experience as SIEM administrator with Splunk in large enterprise environment"" Missing ""Possess industry leading certification in the area of Cyber ...""" Deadline Date: Thursday 22 October 2026 Requirement: Splunk Engineer Location: Mons, BE Full Time On-Site: Yes Time On-Site: 100% Total Scope of the request (hours): 140 Required Start Date: 1 December 2026 End Contract Date: 31 December 2026 Required Security Clearance: NATO SECRET Duties & Role: Under the direction of Cyber Security Data Engineering Cell Head (CSDE), or a delegated authority, the incumbent will perform duties such as the following: • Act as one of the main engineers and Subject Matter Expert (SME) for SIEM and Log collection services within the Cyber Security Data team. • As the SME, you will provide advice and technical assistance to other stakeholders, maintain technical expertise, awareness, and developments in related new technologies, and provide technical contributions to any projects related to the data security systems. • Be responsible for management and further development of the data security systems; • The contractor may occasionally be required to provide on-call support and intervene in the event of an issue to ensure the continued operational availability of the SIEM monitoring infrastructure • Following ITIL standards, provide support to Operations and Service Delivery management covering all stages of the data security systems lifecycle (e.g. Service Design, Transition, Operations, Change Management and Continual Service Improvement). • Ensure that data security systems are installed, configured, and operating correctly and in line with dependencies with others systems or applications required. • Ensure that all system components are continuously monitored and take appropriate technical and non-technical actions for solving detected issues. • Ensure that data security systems operate within any KPI's, as defined in Service Level Agreements with NCSC customers. • Support integration with external tools and any associated activities. • Proactively identify and propose system improvements to ensure an up-to-date and stable environment. • Justify business needs, prepare documentation and implementation plan for the Change Management Board. Implement the approved changes following co-ordination with other stakeholders. • Coordinate with service delivery managers, end users and other stakeholders in support of related services; communicate with other NATO entities as well as industry partners where required; • Develop and maintain documentation guidelines, standard operating procedures, system and service design documents and other relevant documentation that support management of the data security systems. • Create technical and/or executive level reports as required; organise and deliver presentations and briefings for various audience up to NATO executive level. • Perform other duties as may be required. Specific Working Conditions: Normal working hours 0830-1730. On-call duties after working hours, on weekends or holidays are required. If working from a remote location, the contractor shall provide IT equipment for the processing of public and unclassified information in support of their duties, including the capability to participate in video meetings using Microsoft based collaboration tools. The incumbent may require to work on 12 hours pattern during weekdays but not exceeding an average of 38h per week In case of an enterprise-level Cyber Incident, the incumbent may be required to work extended hours and on shifts, including nights and weekends, to provide a 24/7 Cyber Incident Response. Travel required: The contractor may be required to travel to NCIA locations in support of operational duties. In such cases the contractor will be reimbursed for travel costs according to NATO regulations for traveling on NATO duty. Contractors traveling for work purposes shall initiate travel requests from their designated duty station only Requirements Skills, Knowledge & Experience: • The candidate must have a currently active NATO SECRET security clearance • A minimum requirement of a Bachelor's degree from a nationally recognised/certified university in a related discipline and two years post‑related experience. Alternatively, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience of interest to the NCI Agency, provided the candidate has at least five years of extensive and progressive expertise in duties related to the function of the post. • At least 1 year of extensive practical experience as SIEM administrator with Splunk in large enterprise environment (deployment, installation, configuration and maintenance). • Hands-on experience in the design and maintenance of distributed Splunk architectures. • At least 2 years and expert level experience related to SIEM and Log collection management activities. • Demonstrable experience of analysing and interpreting system, security and application logs in order to diagnose faults and spot abnormal behaviours. • Practical hands-on experience in systems and tools administration, especially Linux environment; • Comprehensive knowledge of the principles of computer and communication security, networking, and the vulnerabilities of modern operating systems and applications. • Practical skills in writing Bash, Pytho