CDT-0030 Expert on Defensive Cyberspace Operations Management

Deadline Date: Wednesday 18 November 2026

Requirement: Expert on Defensive Cyberspace Operations Management DSO

Location: Mons, BE

Full Time On-Site: Yes

Total Scope of the request (hours): 1672 hrs (Estimate)

Required Start Date: 4 January 2027

End Contract Date: 31 December 2027

Required Security Clearance: NATO SECRET

Note: For all Level-of-Effort and Completion-Type requests processed outside of the IWC Value Stream, and for which the contractor will not be reimbursed directly by CDT for travel expenses, additional travel funding shall be allocated on a Not-to-exceed basis when the yearly Option is exercised.

Special Terms and Conditions: The contractor will be responsible for complying with the respective national requirements for working permits, visas, taxes, social security etc. whilst working on site at NATO HQ Brussels, Belgium. No special status is either conferred or implied by the host organisation, NATO HQ Brussels, Belgium to the contractor whilst working on site.

1. INTRODUCTION

The NATO Cyber and Digital Transformation (CDT) Division brings Information and Communications Technology (ICT) coherence across NATO Enterprise’s civil and military bodies. CDT is empowered to realize the Allies’ vision for the NATO Enterprise, is accountable to the Secretary General and is responsible for the development of Enterprise directives and advice on the acquisition and use of information technologies and services.

CDT also provides Enterprise oversight on cybersecurity issues, and, in close coordination with all relevant NATO civil and military bodies, works towards the continual improvement of the cyber hygiene and cybersecurity posture in the NATO Enterprise.

CDT is an integrated staff organization comprised of International Staff (IS) and International Military Staff (IMS) members.

CDT supports the planning, coordination and execution of Defensive Cyberspace Operations (DCO) in NATO networks, as one of the leading members of the DCO Planning and Coordination Cell (DPCC).

The incumbent will be responsible for ensuring appropriate coordination amongst the DPCC members ( NATO Cyberspace Operations Centre (CyOC), Joint Intelligence and Security Division (JISD), NATO Communications and Information Agency (NCIA) and CDT). S/He will also be responsible for managing the complete lifecycle of DCOs led by the CDT, including the planning, conduct, assessment, and follow-up phases.

The incumbent must demonstrate in-depth knowledge of advanced technical operations in defence of communication and information systems, but also good knowledge in cyber incident management and cyber risk management best practices and processes.

2. TASKS

The contractor will effectively and efficiently provide, with minimal support, the following services:

Plan, coordinate and oversee advanced technical DCO, incorporating activities such as threat hunting activities, adversary emulation and deception technologies;Draft clear and concise technical and non-technical reports;Working with NATO SMEs, develop relevant red and blue pictures in support of developing DCO plans;Develop DCO plans, supporting processes and procedures;Develop effective and actionable remediation plans based on lessons identified captured through DCO execution;Prepare and deliver presentations to technical and non-technical audiences, in order to facilitate consensus building and decision-making;Coordinate the work of the DPCC, ensuring appropriate communication and cooperation amongst the relevant NATO Enterprise stakeholders;Support the DPCC meetings, in working level and principals level format, facilitating discussions, leading CDT initiatives and providing advice during the DCO lifecycle;Liaise with CyOC, NCIA and other stakeholders for the planning and coordination of any cyberspace activities in the context of DCOs;Support the NATO Enterprise Incident Manager in the coordination and assessment of cybersecurity incident response activities in relation to ongoing DCOs;Support the risk management and decision making processes, coordinating with the NATO Cyber Risk Management Group (CRMG) and the NATO Board of CISOA (BCISOA).

3. PROFILE

[See Requirements]

4. LOCATION OF DUTY

The work will be executed primarily on site at the NATO SHAPE facility in Mons, Belgium.

The contractor is expected to work 5 days a week on site and may perform in specific (but very limited in frequency) situations teleworking at his residence in Belgium, following a security assessment of the place. No teleworking is allowed outside of the respective residence in Belgium.

Frequent travels or short deployments to NATO Command Structure bodies, including N