[6481] Enterprise Cyber Risk Assessment Officer

Start date: Negotiable
Clearance Required: NATO Secret
Location: Brussels, Belgium

Requirements
• Valid NATO SECRET security clearance, held before being considered as a candidate.
• University degree in a relevant technical field, such as Computer Science, Systems Science or Cyber Security, or equivalent technical qualification/experience.
• Comprehensive knowledge of computer and network security principles, networking technologies, and vulnerabilities affecting modern operating systems, applications, cloud services and enterprise platforms.
• Demonstrable experience in vulnerability management, cyber exposure management or cyber risk management.
• Experience in vulnerability analysis, root cause analysis and risk assessment, including mapping technical findings to business or operational impact.
• Experience using vulnerability management tools, risk management platforms, dashboards or GRC solutions.
• Experience securing cloud-based environments and understanding cloud-specific security risks.
• Experience managing or delivering cybersecurity programmes across multiple focus areas, including vulnerability management, risk management and cyber defence.
• Experience working within cross-functional teams and complex reporting structures.
• Strong written and spoken English, with the ability to present and explain complex cybersecurity concepts to technical and non-technical audiences.
• Strong security-focused and analytical mindset, with attention to detail and problem-solving skills.

Desirable Experience and Qualifications:
• Knowledge of NATO Security Policy and its supporting Directives.
• Knowledge of NATO CIS Security Accreditation processes or equivalent national processes.
• Recognised professional certifications in cybersecurity, risk management or project management.

Duties and Role
• Conduct CIS and enterprise-level cyber risk assessments across NATO ICT, cloud, digital and AI-enabled capabilities.
• Perform qualitative and quantitative risk analysis to identify, assess, prioritise and communicate risks affecting NATO operations, mission objectives and Mission Vital Infrastructure.
• Develop risk assessment methodologies, evaluate risk scenarios and analyse risk interdependencies.
• Support the development, implementation and continuous improvement of the NATO Enterprise Risk Management (ERM) Framework.
• Integrate cyber, ICT, cloud, AI, vulnerability, threat and operational risk information into enterprise risk management activities.
• Assess risks associated with cloud services, emerging technologies, AI-enabled systems, automation platforms and digital transformation initiatives.
• Contribute to risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches and governance procedures.
• Support the secure and responsible adoption of cloud and AI capabilities by ensuring associated risks are identified, documented, monitored and communicated.
• Maintain and enhance enterprise risk management tools, risk registries, dashboards and decision-support capabilities.
• Track cyber, cloud, AI and ICT risks, maintaining traceability between technical findings, vulnerabilities, threat assessments, risk treatment actions and risk acceptance decisions.
• Consolidate and analyse information from risk assessments, vulnerability assessments, operational reporting, threat intelligence, audits, security reviews and accreditation activities.
• Produce dashboards, risk posture reports, trend analyses, executive summaries and briefing materials.
• Coordinate with technical teams, service owners, risk owners, operational authorities and security/accreditation stakeholders across NATO.
• Prepare and deliver briefings, presentations and reports to NATO committees, Capability Panels and working groups.
• Provide support for additional requirements relating to cybersecurity, cloud, AI and interoperability, as agreed with CDT.

Specific Working Conditions
• Location: NATO HQ, Brussels, Belgium.
• Clearance: NATO SECRET, required before candidate consideration.
• Contract period: 4 January 2027 – 31 December 2027, with a possible extension for 2028.
• Working arrangement: Five days per week on-site. Very limited teleworking may be permitted from the contractor's residence in Belgium, subject to a security assessment. No teleworking from other locations.
• Working hours: Standard office hours, with occasional non-standard hours for urgent or high-priority tasks.
• Travel: Business travel may be required to coordinate with security engineering stakeholders across NATO entities. Expenses reimbursed under NATO rules, except travel to SHAPE.
• Additional requirement: Signed Non-Disclosure Agreement required.