[6481] Enterprise Cyber Risk Assessment Officer

• Valid NATO SECRET security clearance, held before being considered as a candidate.
• University degree in a relevant technical field, such as Computer Science, Systems Science or Cyber Security, or equivalent technical qualification/experience.
• Comprehensive knowledge of computer and network security principles, networking technologies, and vulnerabilities affecting modern operating systems, applications, cloud services and enterprise platforms.
• Demonstrable experience in vulnerability management, cyber exposure management or cyber risk management.
• Experience in vulnerability analysis, root cause analysis and risk assessment, including mapping technical findings to business or operational impact.
• Experience using vulnerability management tools, risk management platforms, dashboards or GRC solutions.
• Experience securing cloud-based environments and understanding cloud-specific security risks.
• Experience managing or delivering cybersecurity programmes across multiple focus areas, including vulnerability management, risk management and cyber defence.
• Experience working within cross-functional teams and complex reporting structures.
• Strong written and spoken English, with the ability to present and explain complex cybersecurity concepts to technical and non-technical audiences.
• Strong security-focused and analytical mindset, with attention to detail and problem-solving skills.

Start date: Negotiable

Clearance Required: NATO Secret

Location: Brussels, Belgium

Requirements

• Valid NATO SECRET security clearance, held before being considered as a candidate.
• University degree in a relevant technical field, such as Computer Science, Systems Science or Cyber Security, or equivalent technical qualification/experience.
• Comprehensive knowledge of computer and network security principles, networking technologies, and vulnerabilities affecting modern operating systems, applications, cloud services and enterprise platforms.
• Demonstrable experience in vulnerability management, cyber exposure management or cyber risk management.
• Experience in vulnerability analysis, root cause analysis and risk assessment, including mapping technical findings to business or operational impact.
• Experience using vulnerability management tools, risk management platforms, dashboards or GRC solutions.
• Experience securing cloud-based environments and understanding cloud-specific security risks.
• Experience managing or delivering cybersecurity programmes across multiple focus areas, including vulnerability management, risk management and cyber defence.
• Experience working within cross-functional teams and complex reporting structures.
• Strong written and spoken English, with the ability to present and explain complex cybersecurity concepts to technical and non-technical audiences.
• Strong security-focused and analytical mindset, with attention to detail and problem-solving skills.

Desirable Experience and Qualifications

• Knowledge of NATO Security Policy and its supporting Directives.
• Knowledge of NATO CIS Security Accreditation processes or equivalent national processes.
• Recognised professional certifications in cybersecurity, risk management or project management.

Duties and Role

• Conduct CIS and enterprise-level cyber risk assessments across NATO ICT, cloud, digital and AI-enabled capabilities.
• Perform qualitative and quantitative risk analysis to identify, assess, prioritise and communicate risks affecting NATO operations, mission objectives and Mission Vital Infrastructure.
• Develop risk assessment methodologies, evaluate risk scenarios and analyse risk interdependencies.
• Support the development, implementation and continuous improvement of the NATO Enterprise Risk Management (ERM) Framework.
• Integrate cyber, ICT, cloud, AI, vulnerability, threat and operational risk information into enterprise risk management activities.
• Assess risks associated with cloud services, emerging technologies, AI-enabled systems, automation platforms and digital transformation initiatives.
• Contribute to risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches and governance procedures.
• Support the secure and responsible adoption of cloud and AI capabilities by ensuring associated risks are identified, documented, monitored and communicated.
• Maintain and enhance enterprise risk management tools, risk registries, dashboards and decision-support capabilities.
• Track cyber, cloud, AI and ICT risks, maintaining traceability between technical findings, vulnerabilities, threat assessments, risk treatment actions and risk a