Cyber Security Engineer

CONTEXT / INTRODUCTION The mission of the Cyber Security Operations Centre is to strengthen the IT Security of the European Commission by providing state-of-the-art monitoring, detection and response services and tools. Within the unit, the Cybersecurity Engineering and Management (CEM) sector is responsible for the development and operations of supporting capabilities and services by the unit’s principal capability teams of detection, response, and cyber threat intelligence. Within the CEM sector, the Solutions Architecture, Governance, and Engineering (SAGE) team is responsible of custom solutions development using sound DevOps practices, cybersecurity technologies configuration, customization, and deployment, and supporting technical services operations. To secure this multi-environment, multi-technology landscape of solutions and services a strong knowledge of DevSecOps practices, IT risk assurance and vulnerability management, and IT security compliance is equally required. DESCRIPTION OF THE TASKS The external service provider will perform the following tasks:
• Capturing business requirements, defining, validating and coordinating service changes with the other teams in the other sectors that are stakeholders or clients to the services managed by CEM SAGE.
• Acting as Service Owner or Service Delivery Manager for designated technical services and being responsible of the service strategy and operations.
• For the domains of expertise, acting as Site Reliability Engineer for designated technical services, namely as a multi-disciplinary senior specialist covering the underlying infrastructure and operating system, container runtime environments, networking, but also platform specific knowledge for one or more of the critical technology platforms operated by CEM SAGE. Lead or participate in incident and problem management related to such services and platforms.
• Leading or contributing to technical projects of custom software development, to infrastructure and solution development, or in security engineering and customization of various cybersecurity COTS (commercial off the shelf) platforms and tools, part of the technical services portfolio of the Cyber Security Operations Centre.
• Configuring GITLAB pipelines associated with such project that follow European
• Commission’s Unit corporate pipeline practices, including security application and source code testing, automated creation and deployment of required infrastructure, and technical application deployment using sound deployment and rollback strategies. SPECIFIC KNOWLEDGE, SKILLS AND EXPERTISE The following specific knowledge, skills and expertise are required for the performance of the above listed tasks:
• Good cybersecurity domain knowledge, including application and infrastructure security, security risk governance and compliance, and security monitoring, detection, and response methodology, practices, and specific tools.
• Understanding of DevSecOps principles, secure coding practices, and experience with tools for static and dynamic analysis, compliance scanning, and vulnerability assessment.
• Technical proficiency in programming and scripting languages, at them minimum with
• Python and Shell scripting.
• Technical proficiency in Infrastructure as Code (IaC) languages, frameworks, or technologies, at the minimum Terraform or OpenTofu, with AWS CloudFormation and Azure Bicep as a plus.
• Technical proficiency in configuration management and infrastructure automation solutions, at the minimum Ansible content development and Ansible Automation Platform, with Chef or Puppet as an additional advantage.
• Experience with DevSecOps tools and technologies such as CI/CD tools
- GitLab CI/CD,
• Jenkins, GitHub Actions, GitLab runners, SDLC tooling integration into the DevOps pipelines.
• Very good knowledge and experience in containerization and orchestration, with proficiency in deploying Docker or Podman based solutions and workloads, familiarity with Kubernetes based orchestration platforms, and Kubernetes-based workflow management solutions like ArgoCD.
• Familiarity with monitoring and observability tools such as Dynatrace, Prometheus, Grafana, ELK Stack, and the ability to set up effective logging, monitoring, and alerting systems.
• A solid foundation knowledge of networking concepts (e.g., TCP/IP, virtual networking, segmentation) and security (e.g., SSL/TLS, firewall, VPN, load balancers, ingress controllers) to troubleshoot and secure applications and infrastructure.
• Experience with Security Orchestration and Automation for Response (SOAR) platforms – as platform engineer, with a big advantage for experience with Palo Alto Networks’ Cortex XSOAR in particular, but experience with Splunk Phantom, Swimlane SOAR, or Tines also valuable.
• Excellent communication and collaboration skills, ability to work within a team, adaptability to change, and a continuous learning mindset.
• Strong analysis and problem-solving skills. Ability to adapt to uncertainty and drive action under time pressure in incident or problem scenarios.
• Capability to write clear and structured technical documents.