A public-sector organisation serving citizens through a complex digital environment is strengthening its operational security team. The IT Cyber Security Specialist will work across a hybrid, multisite infrastructure on network security and incident response, with security controls covering firewall, IDS/IPS, NDR, proxy, DNS, WAF and SIEM/XDR. The role combines daily security operations with NIS2 compliance work and a rotating 24/7 on-call arrangement.
The mission
The security operations team protects, detects and responds to threats across an infrastructure spanning several dozen sites, cloud services, varied applications and a large user base. Its work includes maintaining security tools, analysing alerts and improving protection and detection capabilities. The organisation is aligning its security practices with NIS2 requirements for essential entities. Reliable operational security is therefore part of maintaining the digital services used by citizens and internal teams.
As an IT Cyber Security Specialist, you will support security operations across a hybrid infrastructure and connect daily controls with broader security projects. You will analyse incidents and network flows, coordinate the teams involved in resolution, and improve the configuration of security tools. During the rotating on-call schedule, you will handle priority 1 and 2 incidents, with some alerts requiring action within 30 minutes.
Your responsibilities
- Resolve security incidents by analysing alerts, assessing impact, escalating appropriately and documenting the actions through closure.
- Coordinate SOC, infrastructure, network and application teams during incident response and follow up the resulting remediation plans.
- Tune protection and detection rules across WAF, IDS/IPS, NDR, proxy and related network security tools to improve signal quality and coverage.
- Investigate network flows and correlate alerts from SIEM, XDR and other security controls to identify relevant threats and risks.
- Control security exceptions and changes by assessing impact, recording the rationale and maintaining clear change logs and technical documentation.
- Produce operational security reporting including incident reports, post-incident recommendations, NIS2 notifications, dashboards and security KPI follow-up.
Your profile
Essential skills
- Bring medior-level experience as an incident responder and/or incident manager, including incident analysis, escalation, coordination and resolution.
- Operate and tune IPS/IDS or NDR security tools, using traffic analysis and alert correlation to support investigations.
- Secure and administer controls covering firewalls, DNS, proxies and WAF in complex network and infrastructure environments.
- Handle alerts from a SOC, SIEM or XDR platform and translate findings into concrete response or remediation actions.
- Apply security monitoring and threat intelligence concepts, including CVEs, IOCs and MITRE ATT&CK techniques.
- Follow rigorous change management and exception processes, with clear documentation and risk-based impact assessment.
- Use ITSM tools, including Jira Service Management for security incidents, and contribute to procedures, guides and continuous improvement.
- Communicate clearly, prioritise under pressure and collaborate assertively with multiple technical teams during a 24/7 on-call rotation.