Compliance-as-Code Architect (NIST/ISO, JSON and YAML) for NATO with security clearance

Wlgroup; Den Haag; On-site; EUR 70,000 - 95,000; Full time

Job summary

Wlgroup in The Hague is seeking an architect to digitise its security control baseline, translating written standards into structured, machine-readable data. You would review NIST/ISO baselines, import them into policy-as-code representations, and design the translation framework for automated evidence generation.

The role involves conducting stakeholder sessions, mapping triggers to control identifiers, and tracking issues through remediation to produce the first full system security plan from

Qualifications

• Bachelor's degree in a related discipline with at least three years of experience.
• Three years across NIST and ISO control frameworks; confident JSON and YAML; and regulatory mapping.
• Translating compliance requirements into code.
• Documented experience of process analysis and design.

Responsibilities

• Review existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion.
• Import the baseline into a structured, machine-readable control format.
• Identify and document the technical triggers that the cloud environment can raise.
• Map those triggers to specific control identifiers — policy as code.
• Review sampled automated evidence for completeness, accuracy and fitness to support a system security plan.
• Generate the first full system security plan from automated evidence rather than by hand.
• Run stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic.
• Track issues through to remediation.

Skills

Translate compliance into code

Process analysis and design

NIST/ISO mapping

Education

Bachelor's degree in a related discipline

Tools

JSON

YAML

Job description

A control catalogue written in prose cannot be checked by a machine. Your job would be to change that.

A multinational defence organisation in The Hague, Netherlands is digitising its security control baseline so that compliance can be measured continuously rather than audited once a year. You would architect the translation — from written standards to structured, machine-readable control data.

What you would be doing

• Reviewing the existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion
• Importing that baseline into a structured, machine-readable control format
• Identifying and documenting the technical triggers that the cloud environment can raise
• Mapping those triggers to specific control identifiers — policy as code
• Reviewing sampled automated evidence for completeness, accuracy and fitness to support a system security plan
• Generating the first full system security plan from automated evidence rather than by hand
• Running stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic
• Tracking issues through to remediation

What you would bring

• A bachelor's degree in a related discipline with three years of related experience
• Three years across all of: NIST and ISO control frameworks; confident JSON and YAML; and regulatory mapping
• Translating compliance requirements into code
• Documented experience of process analysis and design

Nice to have

• Real technical knowledge of how allied organisations achieve interoperability
• A working understanding of defence cloud strategy
• ITIL, COBIT or an equivalent

Why this one is worth a look

Very few architects have taken a real control catalogue all the way into code and out again as a generated security plan. This is that piece of work, on a serious estate.