Jobs at World Lending Group (WLG) (Now Hiring) — 221 open

A NATO cyber security operations centre in Mons can only detect what it can see. Theplatforms that give it that visibility - security monitoring, traffic aggregation and full packetcapture across many networks, sites and data centres - need one person who owns them properly. Thatis this role.

What you would be doing

• Delivering and maintaining the network visibility and security monitoring capability theoperations centre works from.
• Acting as the subject matter expert for the operation, configuration and lifecycle of securitymonitoring and packet capture technology.
• Managing that lifecycle end to end: deployment, configuration, maintenance, upgrades,obsolescence and decommissioning.
• Configuring and tuning monitoring, traffic aggregation and packet capture so the datacollection is reliable and the analysis is worth doing.
• Watching platform health, availability, data quality, retention, storage use andperformance.
• Finding and closing the visibility gaps that would otherwise blunt threat detection.
• Troubleshooting Linux, network, connectivity, performance and data collection problems acrossthe monitoring environment.
• Keeping the documentation real - architecture diagrams, inventories, operating procedures,support information.
• Supporting the design of new monitoring solutions, and their integration with the wideranalytics and incident management tooling.
• Working with the security analysts and the detection engineers so monitoring coverage keeps upwith what they need to detect.
• Capacity planning and scalability assessment, and the compliance, audit and assurance work thatcomes with cyber defence technology.
• Supporting cabling, deployment planning and site surveys for monitoring and visibilityinfrastructure, and taking part in cyber defence exercises when they run.

What they are looking for

• Expert knowledge of network security monitoring and cyber defence operations inan enterprise monitoring environment.
• Extensive hands on experience supporting large scale, distributed securitymonitoring across multiple networks, sites, segments or data centres.
• Enterprise experience with security monitoring and packet capture platforms such asCisco Firepower, Corelight and NetWitness.
• Strong hands on work with network visibility, traffic aggregation, packet brokers and packetcapture.
• Proven platform health and performance monitoring, capacity management, troubleshooting andoperational governance.
• An advanced understanding of enterprise networking - concepts, protocols, architectures anddata flows.
• Linux and network troubleshooting: connectivity, packet flow, interfaces, performance andsystem level diagnostics.
• Practical experience of cabling, site surveys and the physical side of deploying monitoringinfrastructure.
• Strong knowledge of security telemetry collection, event correlation, threat detection andthreat hunting.
• English at NATO STANAG 6001 level 3, professional proficiency.
• A relevant cyber security certification - CISM, CISSP or GIAC Security.
• A bachelor's degree in a related discipline with two years of relevant experience;exceptionally, six years or more of progressive experience in the same work instead.

Also valued

• Designing large scale security monitoring and network visibility architectures.
• Integrating monitoring tools with SIEM and SOAR platforms.
• Automation, scripting or orchestration.
• Major platform upgrades, migrations, refreshes and service transition.
• Previous work in an international environment with both military and civilian elements, and aworking knowledge of how NATO is organised.

Practical detail

• Fully on site in Mons, Belgium, in a normal office environment. Equipment isprovided for restricted information.
• 5 October to 30 December 2026, 400 hours in total.
• Occasional travel to other locations in support of operational duties, reimbursed under NATOtravel rules. Travel inside the duty country counts as commuting.
• You must hold a valid clearance and be a citizen of a NATO member country.

If you have kept a sensor estate honest at scale - and you know the difference between adashboard that is green and a capture that is actually complete - this one is for you.