Cyber Security Analyst (SOC) – First Line Security Event Analyst

About the role

Join the NATO Cyber Security Centre as a First Line Security Event Analyst (FLSEA). You will perform initial analysis of logs and network traffic, assess alert severity, and provide remediation recommendations or first‑line response when required.

Key responsibilities

• Research and assess security events within the NATO Cyber Security Centre (NCSC) team.
• Analyze events from firewalls, IDS, anti‑virus, and other network sensors and present clear findings.
• Leverage tools such as log collection, intrusion detection, packet capture, vulnerability assessment, and network devices to enhance investigations.
• Support the end‑to‑end incident handling process.
• Propose optimisations to improve NATO’s overall cyber security posture.

Required profile

• University degree in a technical IT field with at least 1 year of cyber‑security analysis experience, or 3 years of relevant experience without a degree.
• Strong knowledge of computer and communications security principles, TCP/IP networking, Windows and Linux operating systems.
• Understanding of common network security threats and mitigation techniques.
• Ability to work independently and collaboratively, with strong written and spoken communication skills.

Required skills

• Security Information and Event Management (SIEM) tools – e.g., ArcSight, Splunk.
• Network‑based Intrusion Detection Systems (NIDS) – e.g., SourceFire, Palo Alto Networks.
• Log analysis from firewalls, proxies, routers, DNS and other security appliances.
• Network traffic capture and analysis using Wireshark.
• Logical, structured approach to investigating large, complex data sets.