Enterprise Cyber Risk Assessment Officer

h3Duties and Responsibilities /h3 ul liConduct enterprise-level cybersecurity risk assessments across NATO ICT systems, cloud services, digital platforms and AI-enabled capabilities. /li liPerform qualitative and quantitative risk analysis to identify, assess, prioritise and communicate cybersecurity risks and their potential operational impact. /li liDevelop risk assessment methodologies, evaluate risk scenarios and analyse dependencies in accordance with the NATO Enterprise Risk Management (ERM) Framework. /li liSupport the development, implementation and continuous improvement of NATO's Enterprise Risk Management Framework and associated governance processes. /li liAssess cybersecurity risks associated with cloud services, artificial intelligence, emerging technologies and digital transformation initiatives. /li liDevelop and maintain risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches and governance procedures. /li liMaintain and enhance enterprise risk registers, dashboards and risk management tools, ensuring accurate tracking and reporting of identified risks. /li liConsolidate and analyse information from vulnerability assessments, threat intelligence, audits, security reviews and accreditation activities. /li liProduce cybersecurity risk reports, dashboards, trend analyses, executive summaries and briefing materials to support strategic and operational decision-making. /li liCoordinate with technical teams, service owners, risk owners, operational authorities and security/accreditation stakeholders across NATO. /li liPrepare and deliver presentations, technical reports and briefings to NATO committees, Capability Panels and working groups. /li liProvide ad hoc support for cybersecurity, cloud, AI and interoperability-related requirements as requested by NATO. /li /ul h3Requirements and Qualifications /h3 pEssential

requirements:
/p ul liUniversity degree in a relevant technical field, such as Computer Science, Systems Science or Cybersecurity, or equivalent technical qualifications and experience. /li liComprehensive knowledge of computer and network security principles, networking technologies and vulnerabilities affecting modern operating systems, applications, cloud services and enterprise platforms. /li liDemonstrable experience in vulnerability management, cyber exposure management or cybersecurity risk management. /li liExperience in vulnerability analysis, root cause analysis and risk assessment, including translating technical findings into business or operational impact. /li liExperience working with vulnerability management tools, risk management platforms, dashboards or Governance, Risk and Compliance (GRC) solutions. /li liExperience securing cloud-based environments and understanding cloud-specific security risks. /li liExperience managing or delivering cybersecurity programmes across multiple areas, including vulnerability management, risk management and cyber defence. /li liExperience working in cross-functional teams and complex organisational reporting structures. /li liExcellent written and spoken English communication skills, including the ability to present complex cybersecurity concepts to both technical and non-technical audiences. /li liStrong analytical, problem-solving and security-focused mindset, with excellent attention to detail. /li liActive NATO SECRET Security Clearance is mandatory before submission. /li /ul pDesirable

requirements:
/p ul liKnowledge of NATO Security Policy and its supporting Directives. /li liKnowledge of NATO CIS Security Accreditation processes or equivalent national accreditation processes. /li liRecognised professional certifications in cybersecurity, risk management or project management. /li /ul h3Working Conditions /h3 ul liFull-time, five days per week on-site at NATO Headquarters in Brussels. /li liVery limited teleworking may be permitted from the contractor's residence in Belgium, subject to a security assessment. /li liNo teleworking from locations outside the contractor's residence in Belgium. /li liStandard office

working hours
, with occasional non-standard hours required for urgent or high-priority tasks. /li liBusiness travel may be required to coordinate with security engineering stakeholders across NATO entities. /li /ul