Cyber Risk Assessment Specialist (Cloud and AI)

Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.

Who we are supporting

The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium.

The NCIA provides a wide range of services, including:

• Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats.
• Command and Control Systems: The NCIA develops and maintains the systems used by NATO's military commanders to plan and execute operations.
• Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
• Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks.
• Information Management: The NCIA manages NATO's information technology infrastructure, including its databases, applications, and servers.

Overall, the NCIA plays a critical role in ensuring the security and effectiveness of NATO's communication and information technology capabilities.

The program

Assistance and Advisory Service (AAS)

The NATO Communications and Information Agency (NCI Agency) is NATO’s principal C3 capability deliverer and CIS service provider. It provides, maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV, and, when required, stand together in the face of attack under Article V.

To provide these critical services, in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorise's: NATO International Civilians (NIC)'s, Military (Mil), and Interim Workforce Consultants (IWC)'s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce.

Role ID – CDT-0029

Role Background

• We are seeking an experienced cyber risk professional to join the Cyber Risk Management function at NATO Headquarters in Brussels. In this role you will conduct enterprise, service and system-level cyber risk assessments across cloud, AI-enabled and ICT environments. You will also support the NATO Enterprise Risk Management Framework and give CDT leadership the evidence and reporting it needs for accreditation and risk acceptance decisions. You will work with technical teams, risk owners, CIS Operational Authorities, the NATO Office of Security and NCIA, and brief NATO committees and Capability Panels.

Role Duties and Responsibilities

• Conduct and support cyber risk assessments across NATO ICT, cloud, digital and AI-enabled capabilities, using both qualitative and quantitative methods
• Develop risk assessment methodologies, evaluate risk scenarios and analyse risk interdependencies in line with the NATO ERM Framework
• Support the development and continuous improvement of ERM governance processes, taxonomies, metrics and reporting standards
• Assess risks of cloud services, emerging technologies, automation platforms and AI-enabled systems, and communicate them to risk owners and decision-makers
• Maintain and improve risk registries, dashboards and decision-support tools, ensuring traceability between technical findings, vulnerabilities, threat assessments, treatment actions and risk acceptance decisions
• Consolidate inputs from risk and vulnerability assessments, threat intelligence, audits, security reviews and accreditation activities to produce risk posture reports, trend analyses and executive summaries
• Coordinate stakeholders across locations to align on security requirements, risk posture and delivery priorities
• Prepare and deliver briefings, presentations and reports to NATO committees, Capability Panels and working groups
• Support unforeseen and ad hoc cyber, cloud, AI and interoperability requirements as prioritised by CDT

Essential Skills, Experience and Certifications

• Comprehensive knowledge of computer and network security principles, networking technologies, and vulnerabilities in operating systems, applications, cloud services and enterprise platforms
• Demonstrated experience in vulnerability management, cyber exposure management or cyber risk management
• Demonstrable experience in vulnerability analysis, root cause analysis and risk assessment, including mapping technical findings to business or operational impact
• Experience with vulnerability management tools, risk management platforms, dashboards or GRC solutions
• Experience managing or delivering cybersecurity programmes across multiple focus areas (vulnerability management, risk management, cyber defence)
• Demonstrated experience working in cross-functional teams and complex reporting structures
• Strong written and spoken English, with the ability to explain complex cyber security concepts to technical and non-technical audiences
• Strong security-focused and analytical mindset, with attention to detail and problem-solving skills

Desirable Skills, Experience and Certifications

• Experience securing cloud-based environments and understanding cloud-specific security risks
• Knowledge of NATO Security Policy and its supporting Directives
• Knowledge of NATO CIS Security Accreditation processes, or equivalent national processes
• Recognised professional certifications in cyber security, risk management or project management
• Familiarity with NATO structures and processes
• Exposure to AI governance and AI risk

Education

• University degree in a relevant technical field (computer science, systems science, cyber security) or equivalent technical qualification and experience

Working Location

• NATO HQ Brussels

Working Policy

• On-site

Travel

• Some travel to other NATO sites may be required

Security Clearance

• Valid National or NATO Secret personal security clearance