The posting
Deadline Date: Thursday 19 November 2026
Requirement: Enterprise Cyber Risk Assessment Officer
Location: Brussels, BE
Full Time On-Site: Yes
Total Scope of the request (hours): 1780 (Estimate)
Required Start Date: 4 January 2027
End Contract Date: 31 December 2027
Required Security Clearance: NATO SECRET
Special Terms and Conditions: The contractor will be responsible for complying with the respective national requirements for working permits, visas, taxes, social security etc. whilst working on site at NATO HQ Brussels, Belgium. No special status is either conferred or implied by the host organisation, NATO HQ Brussels, Belgium to the contractor whilst working on site. The contractor will be responsible for complying with all the respective National Health regulations in Belgium before taking up the position.
1. INTRODUCTION
The Cyber and Digital Transformation Division (CDT) leads NATO’s digital transformation, cybersecurity and cyber defence efforts, translating NATO priorities into coherent strategies and coordinated delivery across the Alliance to strengthen interoperability, resilience, cybersecurity and operational effectiveness.
CDT drives NATO’s Digital Transformation, a key objective is to strengthen the ability of Allies and the NATO Enterprise to deter, defend against and counter the full spectrum of cyber and cyber-enabled threats at the speed of relevance, comprehensively across the political, military, and technical levels. In particular, strengthen mechanisms and tools to enhance readiness and resilience against cyber threats across the Alliance, focusing in particular on Mission Vital Infrastructure (MVI).
This position contributes to the Cyber Risk Management function of CDT, supporting the risk-informed decision-making process of the ECISOA. It provides specialist analysis and advice to inform CDT leadership’s cybersecurity decisions across the Division’s areas of responsibility.
The Enterprise Cyber Risk Assessment Officer supports NATO’s enterprise-wide governance of cyber, cloud, artificial intelligence (AI), and ICT risks through the conduct of system-, service-, and enterprise-level risk assessments and the delivery of both qualitative and quantitative risk analysis. The role contributes to the continued development and implementation of the NATO Enterprise Risk Management (ERM) Framework, ensuring that technical, operational, and strategic risks are identified, assessed, prioritised, and communicated to support risk-informed decision-making across the NATO Enterprise.
The position has a particular emphasis on cyber risk management within cloud and AI-enabled environments, supporting the secure adoption of emerging technologies while ensuring that associated risks are effectively governed and aligned with NATO security and operational requirements. It will contribute to the assessment of complex digital services, the integration of risk management processes across NATO CIS Operational Authorities (CISOAs), and the enhancement of enterprise-wide visibility of cyber risk.
Working directly with CDT in its role as NATO Enterprise Cybersecurity Risk Owner, the incumbent will help strengthen situational awareness, governance, resilience, and decision-making across NATO’s digital ecosystem. We are seeking a highly motivated professional with strong analytical, technical, and communication skills, as well as experience in cybersecurity, enterprise risk management, cloud technologies, and AI governance. Knowledge of NATO structures and processes would be considered an asset.
2. TASKS
2.1 Enterprise Cyber Risk Assessment and Analysis
Description: Conduct and support CIS and Enterprise-level cyber risk assessments across NATO ICT, cloud, digital, and AI-enabled capabilities. Perform both qualitative and quantitative risk analysis to identify, assess, prioritize, and communicate risks affecting NATO operations, mission objectives, and Mission Vital Infrastructure (MVI). Develop risk assessment methodologies, evaluate risk scenarios, analyse risk interdependencies, and support risk-informed decision making in accordance with the NATO Enterprise Risk Management (ERM) Framework.
Measurement: Success will be measured through the quality, accuracy, consistency, and timeliness of risk assessments, risk analyses, risk treatment recommendations, and decision-support products delivered to stakeholders.
Timeline: Continuously throughout the period of performance.
2.2 Enterprise Cyber, Cloud and AI Risk Governance Support
Description: Support the development, implementation, and continuous improvement of the NATO Enterprise Risk Management (ERM) Framework and associated governance processes. Ensure the integration of cyber, ICT, cloud, artificial intelligence (AI), vulnerability, threat, and operational risk information into enterprise risk management activities. Conduct and support risk assessments related to cloud services, emerging technologies, AI-enabled systems, automation platforms, and digital transformation initiatives. Contribute to the development of risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches, and governance procedures that enable consistent risk identification, assessment, prioritisation, and reporting across the NATO Enterprise. Support the secure and responsible adoption of cloud and AI capabilities by ensuring that associated risks are appropriately identified, documented, monitored, and communicated to relevant risk owners and decision-making authorities. Contribute to the development of governance artefacts, risk recommendations, and decision-support products aligned with NATO security and operational requirements.
Measurement: Success will be measured through the quality and timeliness of risk assessments, governance artefacts, methodologies, risk management products, framework enhancements, and stakeholder acceptance of delivered outputs and recommendations.
Timeline: Continuously throughout the period of performance.
2.3 Risk Registry and Enterprise Risk Visibility Support
Description: Support the maintenance, enhancement, and utilisation of enterprise risk management tools, risk registries, dashboards, and decision-support capabilities. Ensure accurate registration, tracking, monitoring, and reporting of cyber, cloud, AI, and ICT risks. Maintain traceability between technical findings, vulnerabilities, threat assessments, risk treatment actions, risk acceptance decisions, and enterprise risk reporting.
Measurement: Success will be measured through the accuracy, completeness, and timeliness of risk registry updates, dashboard outputs, reporting products, and management information provided to stakeholders.
Timeline: Continuously throughout the period of performance.
2.4 Enterprise Cyber Risk Situational Awareness and Reporting
Description: Support enterprise-wide cyber risk situational awareness by consolidating and analysing information from risk assessments, vulnerability assessments, operational reporting, threat intelligence, audits, security reviews, and accreditation activities. Produce dashboards, risk posture reports, trend analyses, executive summaries, and briefing materials to support operational and strategic decision making across NATO.
Measurement: Success will be measured through the timely delivery of accurate risk posture reports, situational awareness products, executive briefings, and management recommendations.
Timeline: Continuously throughout the period of performance.
2.5 Stakeholder Management and Coordination
Description: Engage and coordinate multiple stakeholders (technical teams, service owners, risk owners, operational authorities, security/accreditation stakeholders) across locations to align on security requirements, risk posture, and delivery priorities. Prepare and deliver briefings and decision-support materials.
Measurement: Success will be measured by the effective and timely feedback provided by and to stakeholders on different documents and products. Accurate reports and products are required.
Timeline: Continuously throughout the period of performance.
2.6 Reporting, Briefings, and Technical Communication
Description: Prepare and deliver briefings, presentations, and reports to NATO committees, Capability Panels, and working groups, clearly communicating technical concepts, progress, and recommendations related to cyber security standards.
Measurement: Success will be measured by the timely delivery of high-quality reports and presentations, documented briefings, and stakeholder feedback demonstrating clarity, relevance, and effectiveness of communication.
Timeline: Continuously throughout the period of performance.
2.7 Support to Unforeseen and Ad Hoc Requirements.
Description: The contractor shall provide support to unforeseen or ad hoc requirements within the scope of cyber security, Cloud, AI, and interoperability as requested and prioritised by CDT. Such support shall be subject to mutual agreement on scope, effort, and priority.
Measurement: Success will be measured by the timely and effective delivery of agreed support activities, as documented in tasking requests, and acceptance of outputs by CDT.
Timeline: Continuously throughout the period of performance.
3. PROFILE
[See Requirements]
4. LOCATION OF DUTY
The contractor will be embedded within CDT, working within the Cyber and Operations Section (CYOP) from the Readiness and Operations Directorate (ROPD), in close coordination with the other CDT sections, NATO Office of Security, NATO Communication and Information Agency (NCIA), Capability Panels, and other stakeholders. The duty location is NATO HQ in Brussels, Belgium.
The contractor is expected to work 5 days a week on site and may perform in specific (but very limited in frequency) situations teleworking at his residence in Belgium, following a security assessment of the place. No teleworking is allowed outside of the respective residence in Belgium.
5. TIMELINES
The services of the contractor are required for the period starting 04th January 2027 until 31th December 2027.
A contract extension is possible for the calendar year 2028. The contract extension will be subject to performance of the contractor and related NATO regulations and budget availability.
6. SPECIFIC WORKING CONDITIONS
The work will be performed in an office-based environment within a secure setting, under standard working hours. Occasional non-standard working hours may be required to support urgent or high-priority tasks.
7. LINK TO CDT OBJECTIVES
The Enterprise Cyber Risk Assessment Officer directly supports Accreditation at the speed of relevance by providing timely, evidence-based risk assessments and risk treatment recommendations to inform accreditation and risk acceptance decisions by the relevant authorities. By maintaining traceability between technical findings, operational impacts, treatment actions, and residual risks, the role supports continuous assurance and enables decision-makers to prioritise mitigation measures in line with mission requirements and evolving threats.
The position also supports the Interoperable Transatlantic Warfighting Cloud by assessing cyber risks associated with cloud services, interconnected systems, and shared dependencies across the NATO Enterprise. Through the analysis of risk scenarios, cross-service interdependencies, and potential operational impacts, the role informs the secure adoption and governance of cloud-enabled capabilities, supporting resilience, interoperability, and trusted information sharing across the Alliance.
In addition, the role contributes to An AI Enabled Alliance by assessing and communicating cyber risks associated with AI-enabled systems, automation, and data-driven capabilities. By integrating these assessments into enterprise risk registers, reporting, and governance processes, the role supports the secure and responsible adoption of AI and enables relevant risk owners to make informed decisions on risk treatment, acceptance, and ongoing monitoring.
8. TRAVEL
The contractor will be expected to undertake business travel in support of specification development and coordination with security engineering stakeholders across NATO entities. Travel expenses will be reimbursed to the individual directly (in addition to the hourly rate) under NATO rules. Travel to Shape will not be reimbursed.
9. SECURITY AND NON-DISCLOSURE AGREEMENT
The contractor must be in possession of a NATO SECRET security clearance before being considered as a candidate.
A signed Non-Disclosure Agreement will be required.
Requirements
3. PROFILE
- The awardee must hold a NATO SECRET Security Clearance.
- The candidate must possess a university degree in a relevant technical field such as computer science, systems science, cyber security, or an equivalent technical qualification/experience.
- The candidate must have comprehensive knowledge of computer and network security principles, networking technologies, and the vulnerabilities affecting modern operating systems, applications, cloud services, and enterprise platforms.
- The candidate must have demonstrated experience in vulnerability management, cyber exposure management or cyber risk management.
- The candidate shall have demonstrable experience in vulnerability analysis, root cause analysis, and risk assessment, including mapping technical findings to business or operational impact.
- The candidate must have experience working with vulnerability management tools, risk management platforms, dashboards, or GRC solutions.
- The candidate should have experience in securing cloud-based environments and understanding cloud-specific security risks.
- The candidate must have experience in the management or delivery of cybersecurity programmes across multiple focus areas, including vulnerability management, risk management, and cyber defence.
- The candidate must have demonstrated experience working within cross- functional teams and complex reporting structures.
- The candidate must demonstrate strong English writing and speaking communication and presentation skills, including the ability to convey complex cyber security concepts to both technical and non-technical audiences.
- The candidate must demonstrate a strong security-focused and analytical mindset, with attention to detail and problem-solving capability.
- Knowledge of NATO Security Policy and its supporting Directives is desirable.
- Knowledge of NATO CIS Security Accreditation processes, or equivalent national processes, is desirable.
- Recognised professional certifications in cyber security, risk management, or project management are desirable.
