Enterprise Cyber Risk Assessment Officer

NCIM; Brussel Hoofdstad; On-site; EUR 90,000 - 130,000; Full time

Job summary

NCIM is seeking a senior cybersecurity risk professional to conduct enterprise-level assessments across NATO ICT systems, cloud services and AI capabilities. You will develop risk methodologies, support NATO's ERM framework and communicate risks to leadership.

The role requires extensive experience in vulnerability management, cloud security and governance, with strong English communication and the ability to work across cross-functional teams within NATO.

Qualifications

• University degree in CS, Systems Science or Cybersecurity, or equivalent experience.
• Knowledge of computer and network security principles and vulnerabilities.
• Experience in vulnerability management or cybersecurity risk management.
• Experience translating technical findings into business impact.
• Experience with vulnerability management tools, risk platforms, or GRC solutions.
• Experience securing cloud environments and cloud security risks.
• Experience delivering cybersecurity programmes across multiple areas.
• Experience in cross-functional teams and complex reporting structures.
• Excellent written and spoken English communication.
• Active NATO SECRET clearance required.

Responsibilities

• Conduct enterprise-level cybersecurity risk assessments across NATO ICT systems, cloud services, digital platforms and AI-enabled capabilities.
• Perform qualitative and quantitative risk analysis to identify, assess, prioritise and communicate cybersecurity risks and their potential operational impact.
• Develop risk assessment methodologies, evaluate risk scenarios and analyse dependencies in accordance with the NATO Enterprise Risk Management (ERM) Framework.
• Support the development, implementation and continuous improvement of NATO's Enterprise Risk Management Framework and associated governance processes.
• Assess cybersecurity risks associated with cloud services, artificial intelligence, emerging technologies and digital transformation initiatives.
• Develop and maintain risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches and governance procedures.
• Maintain and enhance enterprise risk registers, dashboards and risk management tools, ensuring accurate tracking and reporting of identified risks.
• Consolidate and analyse information from vulnerability assessments, threat intelligence, audits, security reviews and accreditation activities.
• Produce cybersecurity risk reports, dashboards, trend analyses, executive summaries and briefing materials to support strategic and operational decision-making.
• Coordinate with technical teams, service owners, risk owners, operational authorities and security/accreditation stakeholders across NATO.
• Prepare and deliver presentations, technical reports and briefings to NATO committees, Capability Panels and working groups.
• Provide ad hoc support for cybersecurity, cloud, AI and interoperability-related requirements as requested by NATO.

Skills

Analytical problem-solving

English communication

Security-focused mindset

Cross-functional teamwork

Education

University degree in CS/Systems Science/Cybersecurity

Job description

Duties and Responsibilities

• Conduct enterprise-level cybersecurity risk assessments across NATO ICT systems, cloud services, digital platforms and AI-enabled capabilities.
• Perform qualitative and quantitative risk analysis to identify, assess, prioritise and communicate cybersecurity risks and their potential operational impact.
• Develop risk assessment methodologies, evaluate risk scenarios and analyse dependencies in accordance with the NATO Enterprise Risk Management (ERM) Framework.
• Support the development, implementation and continuous improvement of NATO's Enterprise Risk Management Framework and associated governance processes.
• Assess cybersecurity risks associated with cloud services, artificial intelligence, emerging technologies and digital transformation initiatives.
• Develop and maintain risk methodologies, taxonomies, metrics, reporting standards, risk treatment approaches and governance procedures.
• Maintain and enhance enterprise risk registers, dashboards and risk management tools, ensuring accurate tracking and reporting of identified risks.
• Consolidate and analyse information from vulnerability assessments, threat intelligence, audits, security reviews and accreditation activities.
• Produce cybersecurity risk reports, dashboards, trend analyses, executive summaries and briefing materials to support strategic and operational decision-making.
• Coordinate with technical teams, service owners, risk owners, operational authorities and security/accreditation stakeholders across NATO.
• Prepare and deliver presentations, technical reports and briefings to NATO committees, Capability Panels and working groups.
• Provide ad hoc support for cybersecurity, cloud, AI and interoperability-related requirements as requested by NATO.

Requirements and Qualifications

Essential requirements:

• University degree in a relevant technical field, such as Computer Science, Systems Science or Cybersecurity, or equivalent technical qualifications and experience.
• Comprehensive knowledge of computer and network security principles, networking technologies and vulnerabilities affecting modern operating systems, applications, cloud services and enterprise platforms.
• Demonstrable experience in vulnerability management, cyber exposure management or cybersecurity risk management.
• Experience in vulnerability analysis, root cause analysis and risk assessment, including translating technical findings into business or operational impact.
• Experience working with vulnerability management tools, risk management platforms, dashboards or Governance, Risk and Compliance (GRC) solutions.
• Experience securing cloud-based environments and understanding cloud-specific security risks.
• Experience managing or delivering cybersecurity programmes across multiple areas, including vulnerability management, risk management and cyber defence.
• Experience working in cross-functional teams and complex organisational reporting structures.
• Excellent written and spoken English communication skills, including the ability to present complex cybersecurity concepts to both technical and non-technical audiences.
• Strong analytical, problem-solving and security-focused mindset, with excellent attention to detail.
• Active NATO SECRET Security Clearance is mandatory before submission.

Desirable requirements:

• Knowledge of NATO Security Policy and its supporting Directives.
• Knowledge of NATO CIS Security Accreditation processes or equivalent national accreditation processes.
• Recognised professional certifications in cybersecurity, risk management or project management.

Working Conditions

• Full-time, five days per week on-site at NATO Headquarters in Brussels.
• Very limited teleworking may be permitted from the contractor's residence in Belgium, subject to a security assessment.
• No teleworking from locations outside the contractor's residence in Belgium.
• Standard office working hours, with occasional non-standard hours required for urgent or high-priority tasks.
• Business travel may be required to coordinate with security engineering stakeholders across NATO entities.