CyberSecurity L&M Service Specialist (Warsaw, 80% remote) – Frontex

CyberSecurity L&M Service Specialist (Warsaw, 80% remote) – Frontex Join Frontex as a Cybersecurity Logging & Monitoring Specialist, shaping Splunk and Cribl solutions with a 20% on-site, 80% remote setup in Warsaw. Send request CyberSecurity L&M Service Specialist (Warsaw, 80% remote) – Frontex Profile: CyberSecurity L&M Service Specialist (Logging and Monitoring, Splunk and Cribl solutions, SecOps, Threat Modelling). Place of performance: On-site service provision - Frontex Headquarters – 20% on-site + 80% remote. Duration of the mission: 48 months. Security Clearance: Is required (valid from the first day of assignment) - CONFIDENTIEL UE/EU CONFIDENTIAL. Minimum level of education: Level 6. Minimum English language skills: B2. Minimum IT relevant experience: 10 years (8 years in relevant roles). Award Criteria: 50% Price / 50% Quality. Minimum required scoring for interview: 70%. Travel expenses: Not foreseen. Rate: Flexible. The rate offered depends on the candidate’s level, in accordance with the European public grading system. Further details are available upon discussion. · NWH: 230days x4 years. Required technical certificates: At least 3 certifications are required among: · CISSP or an equivalent certification. · CCSP or an equivalent certification. · GIAC Penetration Tester (GPEN) or an equivalent certification. · Splunk Enterprise Certified Admin. · Splunk Enterprise Security Certified Admin. · At least TOGAF 9 Certified. · Note: each equivalent alternative means certification recognized internationally (subject and scope to acceptance by Frontex as a valid credential). Knowledge and Skills · Knowledge of the Systems Development Life Cycle, with a strong understanding of Secure SDLC practices and the integration of security controls throughout the software development phases. · Knowledge of OS-level security architecture, including configuration auditing, access controls, and security event log analysis for Windows and Linux platforms. · Knowledge of network security architecture, including secure protocols, network segmentation, and the analysis of network traffic and telemetry logs. · Knowledge of enterprise security controls, including the design, implementation, and tactical understanding of what security telemetry to monitor and how to detect anomalies effectively. · Knowledge of offensive security practices, including penetration testing methodologies, red teaming operations, and understanding of real-world adversarial tactics and techniques. · Knowledge of defensive security practices, including security monitoring, incident triage, threat hunting, and the engineering of detection rules to systematically neutralize threat actors. · Knowledge of system security vulnerabilities, emerging cyber threats, and exploit mechanisms utilized by threat actors. · Knowledge of MITRE ATT&CK and MITRE D3FEND frameworks, with a proven ability to map offensive adversary TTPs to defensive countermeasures to optimize security architecture. · Proficient in providing technical support for the implementation and configuration of diverse security controls across the enterprise security ecosystem. · Proficient in authoring and testing secure scripts to automate security workflows, detection logic, and infrastructure management. · Proficient in identifying and troubleshooting cybersecurity monitoring related issues to ensure system integrity and minimize operational impact. · Experience in the administration, lifecycle management, and integration of enterprise security platforms, specifically focusing on data ingestion pipelines via Cribl Stream, and the architecture of Splunk Enterprise, Splunk Enterprise Security, Splunk SOAR, and Splunk UBA ecosystems · Experience in developing, testing, and fine-tuning correlation searches within Splunk Enterprise Security, utilizing MITRE ATT&CK and D3FEND frameworks to map threat behaviors and optimize detection logic. · Experience in utilizing Infrastructure as Code (IaC) methodologies and CI/CD automation tools, specifically Azure DevOps, to deploy, configure, and manage security controls, Splunk Enterprise. Splunk Enterprise Security, and Cribl Stream infrastructure. · Proficiency in building and maintaining automated playbooks within Splunk SOAR. · Experience in designing tailored security monitoring capabilities, including the creation of High-Level Designs (HLD), Low-Level Designs (LLD), and technical blueprints as core architecture documentation. · Proficiency in technical report writing, with the ability to translate complex security metrics and incidents into actionable executive insights. · Experience in drafting security procedures and policies, with an emphasis on information protection and data privacy. · Experience in authoring comprehensive business cases to justify and launch new cybersecurity initiatives and technology deployments. · Experience in supporting the evaluation and selection of Managed Security Service Providers (MSSPs) and cybersecurity technology vendors through technical validation and capability mapping. · Experience in defining and developing strategic roadmaps for cybersecurity capabilities, coupled with the ability to effectively present and justify these roadmaps to executive sponsors and key stakeholders to secure funding and alignment. Tasks and Responsibilities · Knowledge of the Systems Development Life Cycle, with a strong understanding of Secure SDLC practices and the integration of security controls throughout the software development phases. · Knowledge of OS-level security architecture, including configuration auditing, access controls, and security event log analysis for Windows and Linux platforms. · Knowledge of network security architecture, including secure protocols, network segmentation, and the analysis of network traffic and telemetry logs. · Knowledge of enterprise security controls, including the design, implementation, and tactical understanding of what security telemetry to monitor and how to detect anomalies effectively. · Knowledge of offensive security practices, including penetration testing methodologies, red teaming operations, and understanding of real-world adversarial tactics and techniques. · Knowledge of defensive security practices, including security monitoring, incident triage, threat hunting, and the engineering of detection rules to systematically neutralize threat actors. · Knowledge of system security vulnerabilities, emerging cyber threats, and exploit mechanisms utilized by threat actors. · Knowledge of MITRE ATT&CK and MITRE D3FEND frameworks, with a proven ability to map offensive adversary TTPs to defensive countermeasures to optimize security architecture. · Proficient in providing technical support for the implementation and configuration of diverse security controls across the enterprise security ecosystem. · Proficient in authoring and testing secure scripts to automate security workflows, detection logic, and infrastructure management. · Proficient in identifying and troubleshooting cybersecurity monitoring related issues to ensure system integrity and minimize operational impact. · Experience in the administration, lifecycle management, and integration of enterprise security platforms, specifically focusing on data ingestion pipelines via Cribl Stream, and the architecture of Splunk Enterprise, Splunk Enterprise Security, Splunk SOAR, and Splunk UBA ecosystems. · Experience in developing, testing, and fine-tuning correlation searches within Splunk Enterprise Security, utilizing MITRE ATT&CK and D3FEND frameworks to map threat behaviors and optimize detection logic. · Experience in utilizing Infrastructure as Code (IaC) methodologies and CI/CD automation tools, specifically Azure DevOps, to deploy, configure, and manage security controls, Splunk Enterprise. Splunk Enterprise Security, and Cribl Stream infrastructure. · Proficiency in building and maintaining automated playbooks within Splunk SOAR. · Experience in designing tailored security monitoring capabilities, including the creation of High-Level Designs (HLD), Low-Level Designs (LLD), and technical blueprints as core architecture documentation. · Proficiency in technical report writing, with the ability to translate complex security metrics and incidents into actionable executive insights. · Experience in drafting security procedures and policies, with an emphasis on information protection and data privacy. · Experience in authoring comprehensive business cases to justify and launch new cybersecurity initiatives and technology deployments. · Experience in supporting the evaluation and selection of Managed Security Service Providers (MSSPs) and cybersecurity technology vendors through technical validation and capability mapping. · Experience in defining and developing strategic roadmaps for cybersecurity capabilities, coupled with the ability to effectively present and justify these roadmaps to executive sponsors and key stakeholders to secure funding and alignment. Departamento IT Puesto CONSULTOR/A Ubicaciones Warsaw Estado remoto Híbrido ¿Qué ofrecemos? Horarios TheWhiteam ofrece horarios flexibles. Esto se debe a que buscamos cumplir objetivos, no llegar a una cantidad de horas. Tecnologias Las tecnologías más punteras, para estar actualizados a los cambios del momento. Modalidad de Trabajo Dada la situación TheWhiteam da la posibilidad de una modalidad de trabajo presencial, teletrabajo o mixta. Ubicaciones TheWhiteam da la posibilidad de trabajar en ubicaciones situadas por todo el mundo. Lugar de trabajo Formar parte de THEWHITEAM es colaborar con una empresa formada por profesionales con una dilatada experiencia en consultoría tecnológica. Creemos firmemente que las empresas y clientes marcan el camino a seguir en el sector, pero éste lo construyen las personas. Consideramos de vital importancia que nuestra organización se fundamente en nuestro mejor activo y marca de valor añadido que es nuestro equipo humano . Acerca de The White Team Fundada en 2012 por consultores experimentados The Whiteam nace como consultora tecnológica de calidad con una misión clara; ayudar a las compañías de todo el mundo a optimizar su rentabilidad empresarial a través de un uso eficiente de las tecnologías de la información.