Compliance-as-Code Architect: NIST/ISO to Auto Plans

Wlgroup; Den Haag; On-site; EUR 70,000 - 95,000; Full time

Job summary

Wlgroup in The Hague is seeking an architect to digitise its security control baseline, translating written standards into structured, machine-readable data. You would review NIST/ISO baselines, import them into policy-as-code representations, and design the translation framework for automated evidence generation.

The role involves conducting stakeholder sessions, mapping triggers to control identifiers, and tracking issues through remediation to produce the first full system security plan from

Qualifications

• Bachelor's degree in a related discipline with at least three years of experience.
• Three years across NIST and ISO control frameworks; confident JSON and YAML; and regulatory mapping.
• Translating compliance requirements into code.
• Documented experience of process analysis and design.

Responsibilities

• Review existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion.
• Import the baseline into a structured, machine-readable control format.
• Identify and document the technical triggers that the cloud environment can raise.
• Map those triggers to specific control identifiers — policy as code.
• Review sampled automated evidence for completeness, accuracy and fitness to support a system security plan.
• Generate the first full system security plan from automated evidence rather than by hand.
• Run stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic.
• Track issues through to remediation.

Skills

Translate compliance into code

Process analysis and design

NIST/ISO mapping

Education

Bachelor's degree in a related discipline

Tools

JSON

YAML

Job description

Wlgroup in The Hague is seeking an architect to digitise its security control baseline, translating written standards into structured, machine-readable data. You would review NIST/ISO baselines, import them into policy-as-code representations, and design the translation framework for automated evidence generation.

The role involves conducting stakeholder sessions, mapping triggers to control identifiers, and tracking issues through remediation to produce the first full system security plan from