Requirement: DFIR Tool Engineer
Location: Mons, BELGIUM
Full Time On-Site: Yes
Time On-Site: 100%
Not to Exceed Rate: 71 EUR
Total Scope of the request (hours): 395
Required Start Date: 26 October 2026
End Contract Date: 31 December 2026
Required Security Clearance: NATO COSMIC TOP SECRET
Duties & Role:
Under the direction of the Section Head of CTIS the contractor shall:
- Deploy, configure, monitor, troubleshoot and maintain the suite of digital forensics and XDR tools, ensuring all systems are kept up to date in accordance with IT Service Management (ITSM) processes.
- Integrate user feedback and implement enhancements to improve usability and effectiveness, which may include developing automation scripts or custom configurations to meet operational requirements.
- Work onsite, at SHAPE, Mons, Belgium, for coordination purposes and due to the accesses required.
- Support change management processes to deliver & maintain tools and capabilities from the section.
- Execute coordination and information gathering activities within NCSC, NCIA, and with other NATO & external stakeholders, in support of the above activities.
Skills, Knowledge & Experience:
- The candidate must have a currently active NATO COSMIC TOP SECRET security clearance
- A minimum requirement of a Bachelor's degree at a nationally recognised/certified University in a related discipline and 3 years post-related experience;
- Or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience that is/are of interest to NCIA, that is, at least 10 years extensive and progressive expertise in duties related to those in this Statement of Work.
- At least 5 years of experience in deploying, managing and maintaining forensics and XDR tools in complex environments.
- At least 2 years of experience with remote acquisition tooling (Fidelis and/or F-Response) with demonstrated ability to configure, support deployment at scale including resolving failed collections and performance issues.
- At least 2 years of experience with collaboration tools such as Jira and Confluence;
- Strong understanding of forensically sound acquisition principles (integrity verification, repeatability, minimizing system impact).
- Windows Server/Desktop administration skills: services, drivers, certificates, event logs, permissions, remote management.
- Ability to diagnose host-level issues impacting forensic tools (resource contention, disk I/O, endpoint controls, OS patch impacts).
- Experience with Red Hat Linux and managing a fleet of servers with Ansible.
- Experience working with vendors (support tickets, log bundles, upgrades) and communicating impacts/ETAs to investigators/analysts.
- Experience implementing least-privilege access, credential handling, and audit logging for forensic systems.
- Knowledge and demonstrable experience with scripting languages and integration tools including PowerShell, Python , Bash, Batch and Ansible.
- Very good communication and analytical skills.
- Good understanding of cyber security concepts.
- Good understanding of network communication protocols.
- Have an in-depth understanding of infrastructure concepts related to Hosting, Networks, IP address Management, firewalls, certificates, Load balancing and Proxy.
- Language proficiency in English: meet or exceed the NATO STANAG 6001 Level 3 "Professional Proficiency".
- Ability to produce detailed technical documentation and follow change management processes.
- Relevant certifications in cyber security, GIAC (Global Information Assurance Certification) or equivalent.
