Cyber Security Engineer
Duties & Responsibilities
The Cyber Security Engineer will work under the direction of C2SS, NCSC, and will be responsible for supporting the design, implementation, operation, and assurance of secure IT solutions. The role requires close collaboration with technical teams, architects, security stakeholders, and business representatives to ensure compliance with NATO security policies and standards.
Key duties include:
Solution Architecture
- Support the development of security-compliant solution architectures for AirC2 and related mission-support environments.
- Contribute to the definition, documentation, and justification of architecturally significant security decisions.
- Produce technical specifications for cloud-based and on-premises infrastructure components, services, interfaces, and security capabilities.
- Support technical planning activities for projects, system enhancements, and change initiatives.
- Ensure proposed solutions align with enterprise architecture frameworks, security policies, and NATO security standards.
Security Engineering
- Configure, test, maintain, and troubleshoot security technologies and services supporting C2SS environments.
- Support the integration of local security capabilities with centralized security monitoring and management infrastructures.
- Ensure appropriate compensating security measures are implemented where direct integration with centralized services is not possible.
- Evaluate security technologies and recommend improvements based on operational requirements and threat developments.
Information Security & Risk Management
- Implement and maintain security controls in accordance with organizational policies, security requirements, and risk assessments.
- Identify, assess, document, and communicate cybersecurity risks, vulnerabilities, and potential impacts.
- Develop and recommend mitigation strategies, countermeasures, and alternative technical solutions.
- Define secure system configurations aligned with approved security architectures.
- Support investigations into suspected cyber incidents, attacks, and security breaches.
- Conduct technical risk assessments and contribute to risk treatment plans.
- Identify common security risk indicators and recommend preventive measures.
- Maintain accurate security documentation and records to support auditability and decision-making.
Information Assurance
- Support technical assessments of information systems against NATO information assurance requirements and security policies.
- Provide assistance with system accreditation activities, security assessments, and compliance reviews.
- Contribute to maintaining security assurance throughout the system lifecycle.
Requirements Definition & Change Management
- Support requirements gathering, analysis, documentation, and prioritization activities for cybersecurity-related changes.
- Apply established methods and standards to capture and manage technical and security requirements.
- Review requirements for completeness, consistency, and compliance.
- Maintain requirements traceability and contribute to requirements baselines.
- Assess and manage approved changes to security requirements in accordance with change management procedures.
- Collaborate with stakeholders to resolve conflicts and ensure security requirements are effectively addressed.
General Responsibilities
- Recognize issues requiring escalation and refer decisions beyond assigned authority to appropriate stakeholders.
- Provide technical advice and security guidance to project teams and operational stakeholders.
- Prepare and deliver technical briefings and security reports in English.
- Perform other cybersecurity-related duties as assigned.
- Perform duties primarily on-site at the designated NATO facility, with limited remote work subject to approval and operational requirements.
Education & Professional Experience
- Bachelor of Science (BSc) degree from a nationally recognized/certified university in a technical discipline with substantial Information Technology (IT) content.
- Minimum of 3 years of post-related professional experience in cybersecurity, information security, or related IT security engineering roles.
- Candidates without a university degree may be considered if they demonstrate at least 5 years of extensive and progressive experience performing comparable cybersecurity duties.
Technical Skills & Knowledge
Candidates must demonstrate extensive knowledge and practical experience in:
- Security monitoring and security operations processes.
- Public Key Infrastructure (PKI) and certificate management.
- Vulnerability management and security assessment activities.
- Identity and Access Management (IAM) solutions and principles.
- Security product evaluation, testing, and implementation.
- UNIX/Linux and Microsoft Windows system administration.
- Network security concepts, protocols, and defensive security technologies.
- Secure system design principles, including Zero Trust and Data-Centric Security architectures.
- Cybersecurity risk assessment methodologies and mitigation planning.
- Security controls implementation and compliance monitoring.
- Incident investigation and response support.
Communication & Reporting Skills
- Ability to produce clear, structured, and technically accurate documentation in English, including:
- Executive summaries.
- Technical assessments.
- Security findings.
- Risk descriptions.
- Remediation recommendations.
- Ability to conduct technical briefings and communicate cybersecurity topics effectively to technical and non-technical audiences.
Security Clearance
- NATO Secret security clearance required.
- Previous experience working in an international organization involving both military and civilian stakeholders.
- Experience working within a NATO environment or familiarity with NATO structures, processes, and operational requirements.
- Experience supporting multinational security projects and cross-functional technical teams.
- Knowledge of NATO security policies, information assurance practices, and accreditation processes.