Enterprise Cyber Risk Assessment Officer

Duties and Responsibilities

• Conduct enterprise-level cybersecurity risk assessments across NATO ICT systems, cloud services, digital platforms and AI-enabled capabilities.

• Perform qualitative and quantitative risk analysis to identify, assess, prioritise and communicate cybersecurity risks and their potential operational impact.

• Develop risk assessment methodologies, evaluate risk scenarios and analyse dependencies in accordance with the NATO Enterprise Risk Management (ERM) Framework.

• Support the development, implementation and continuous improvement of NATO's Enterprise Risk Management Framework and associated governance processes.

• Assess cybersecurity risks associated with cloud services, artificial intelligence, emerging technologies and digital transformation initiatives.

• Develop and maintain risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches and governance procedures.

• Maintain and enhance enterprise risk registers, dashboards and risk management tools, ensuring accurate tracking and reporting of identified risks.

• Consolidate and analyse information from vulnerability assessments, threat intelligence, audits, security reviews and accreditation activities.

• Produce cybersecurity risk reports, dashboards, trend analyses, executive summaries and briefing materials to support strategic and operational decision-making.

• Coordinate with technical teams, service owners, risk owners, operational authorities and security/accreditation stakeholders across NATO.

• Prepare and deliver presentations, technical reports and briefings to NATO committees, Capability Panels and working groups.

• Provide ad hoc support for cybersecurity, cloud, AI and interoperability-related requirements as requested by NATO.

Requirements and Qualifications

Essential requirements:

• University degree in a relevant technical field, such as Computer Science, Systems Science or Cybersecurity, or equivalent technical qualifications and experience.

• Comprehensive knowledge of computer and network security principles, networking technologies and vulnerabilities affecting modern operating systems, applications, cloud services and enterprise platforms.

• Demonstrable experience in vulnerability management, cyber exposure management or cybersecurity risk management.

• Experience in vulnerability analysis, root cause analysis and risk assessment, including translating technical findings into business or operational impact.

• Experience working with vulnerability management tools, risk management platforms, dashboards or Governance, Risk and Compliance (GRC) solutions.

• Experience securing cloud-based environments and understanding cloud-specific security risks.

• Experience managing or delivering cybersecurity programmes across multiple areas, including vulnerability management, risk management and cyber defence.

• Experience working in cross-functional teams and complex organisational reporting structures.

• Excellent written and spoken English communication skills, including the ability to present complex cybersecurity concepts to both technical and non-technical audiences.

• Strong analytical, problem-solving and security-focused mindset, with excellent attention to detail.

• Active NATO SECRET Security Clearance is mandatory before submission.

Desirable requirements:

• Knowledge of NATO Security Policy and its supporting Directives.

• Knowledge of NATO CIS Security Accreditation processes or equivalent national accreditation processes.

• Recognised professional certifications in cybersecurity, risk management or project management.

Working Conditions

• Full-time, five days per week on-site at NATO Headquarters in Brussels.

• Very limited teleworking may be permitted from the contractor's residence in Belgium, subject to a security assessment.

• No teleworking from locations outside the contractor's residence in Belgium.

• Standard office working hours, with occasional non-standard hours required for urgent or high-priority tasks.

• Business travel may be required to coordinate with security engineering stakeholders across NATO entities.