Enterprise Cyber Risk Assessment Officer

Duties and Responsibilities

• Conduct enterprise-level cybersecurity risk assessments across NATO ICT systems, cloud services, digital platforms and AI-enabled capabilities.
• Perform qualitative and quantitative risk analysis to identify, assess, prioritise and communicate cybersecurity risks and their potential operational impact.
• Develop risk assessment methodologies, evaluate risk scenarios and analyse dependencies in accordance with the NATO Enterprise Risk Management (ERM) Framework.
• Support the development, implementation and continuous improvement of NATO's Enterprise Risk Management Framework and associated governance processes.
• Assess cybersecurity risks associated with cloud services, artificial intelligence, emerging technologies and digital transformation initiatives.
• Develop and maintain risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches and governance procedures.
• Maintain and enhance enterprise risk registers, dashboards and risk management tools, ensuring accurate tracking and reporting of identified risks.
• Consolidate and analyse information from vulnerability assessments, threat intelligence, audits, security reviews and accreditation activities.
• Produce cybersecurity risk reports, dashboards, trend analyses, executive summaries and briefing materials to support strategic and operational decision-making.
• Coordinate with technical teams, service owners, risk owners, operational authorities and security/accreditation stakeholders across NATO.
• Prepare and deliver presentations, technical reports and briefings to NATO committees, Capability Panels and working groups.
• Provide ad hoc support for cybersecurity, cloud, AI and interoperability-related requirements as requested by NATO.

Requirements and Qualifications

Essential requirements:

• University degree in a relevant technical field, such as Computer Science, Systems Science or Cybersecurity, or equivalent technical qualifications and experience.
• Comprehensive knowledge of computer and network security principles, networking technologies and vulnerabilities affecting modern operating systems, applications, cloud services and enterprise platforms.
• Demonstrable experience in vulnerability management, cyber exposure management or cybersecurity risk management.
• Experience in vulnerability analysis, root cause analysis and risk assessment, including translating technical findings into business or operational impact.
• Experience working with vulnerability management tools, risk management platforms, dashboards or Governance, Risk and Compliance (GRC) solutions.
• Experience securing cloud-based environments and understanding cloud-specific security risks.
• Experience managing or delivering cybersecurity programmes across multiple areas, including vulnerability management, risk management and cyber defence.
• Experience working in cross-functional teams and complex organisational reporting structures.
• Excellent written and spoken English communication skills, including the ability to present complex cybersecurity concepts to both technical and non-technical audiences.
• Strong analytical, problem-solving and security-focused mindset, with excellent attention to detail.
• Active NATO SECRET Security Clearance is mandatory before submission.

Desirable requirements:

• Knowledge of NATO Security Policy and its supporting Directives.
• Knowledge of NATO CIS Security Accreditation processes or equivalent national accreditation processes.
• Recognised professional certifications in cybersecurity, risk management or project management.

Working Conditions

• Full-time, five days per week on-site at NATO Headquarters in Brussels.
• Very limited teleworking may be permitted from the contractor's residence in Belgium, subject to a security assessment.
• No teleworking from locations outside the contractor's residence in Belgium.
• Standard office working hours, with occasional non-standard hours required for urgent or high-priority tasks.
• Business travel may be required to coordinate with security engineering stakeholders across NATO entities.