Cyber Security Expert

EUROCONTROL; Maastricht; On-site; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

EUROCONTROL Maastricht Centre seeks an experienced cyber security specialist to define security policies, assess risks, and support governance across networks and cloud environments.

The role involves incident response, threat intelligence, and ensuring compliance with ISO 27001/NIST CSF. You will work in a multinational setting with hybrid work options and engage with internal teams and external partners.

Qualifications

• Completion of third level IT/security studies to EQF 6 with 4+ years’ experience.
• EQF Level 7 with 3+ years’ experience where appropriate.
• Experience in cyber security risk assessments and control evaluations.
• Knowledge of standards like ISO 27001/NIST CSF.

Responsibilities

• Define security requirements, policies and action plans for networks, on site and cloud.
• Develop methods and tools for harmonised security management.
• Lead incident response and crisis management activities.
• Audit security measures and monitor compliance with regulations.
• Provide cyber security guidance to management and stakeholders.
• Conduct security risk assessments and report findings.
• Monitor aviation cyber threats and produce CTI reports.
• Develop training content and deliver security awareness programs.

Skills

Security risk assessments

Threat and vulnerability analysis

Governance, risk & compliance

Incident response

Regulatory compliance

Analytical thinking

Communication

Team collaboration

Education

EQF Level 6 IT/Security studies

EQF Level 7 IT/Security studies

Tools

ISO 27001

NIST CSF

CIS

Job description

• In accordance with the Service Regulations, staff are required to reside either at their place of employment or at such distance from it as is compatible with the proper performance of their duties.
• Nature of competition: Internal and external competition
• Applicable regulations: General conditions of employment governing servants at the EUROCONTROL Maastricht Centre
• Duration of appointment: 5 Year(s) - renewal or conversion of the contract is possible under certain conditions see “Useful information” section
• Security clearance: Security vetting may be required in accordance with the relevant EUROCONTROL security provisions
• Directorate/Service: MUAC/SQCS/CS - The Corporate Security Team
• Working arrangement: EUROCONTROL operates a hybrid working model, combining onsite presence with teleworking opportunities. Teleworking is subject to the applicable internal rules and is granted in line with business needs and managerial approval.Teleworking must not exceed 50% of the days worked in a month when performed at the official place of residence as defined above.In addition, all staff may telework from a location of their choice for up to 20 working days per calendar year, with line manager authorisation. These 20 days do not count towards the 50% monthly limit.
• Reserve list: Applicable - See details in the "Useful information" section

Your team

Within the The Directorate Maastricht Upper Area Control Centre , The Safety, Quality, Compliance and Security Management (SQCS) unit manages MUAC's safety, quality, compliance and security processes. The unit is also responsible for the overall management of the integrated MUAC Management System including the assurance of its effective and efficient operation. Furthermore, the MUAC Security Operations Center (SOC) is part of SQCS.

Your role

Your role will be to:

• Provide technicalexpertise,guidanceandcontributionstothedefinition of security requirements, the development and the execution of security-related policies, procedures, and action plans to ensure the protection of mission critical networks,systemsand services, on site and/or in the cloud.
• Contribute to the development of methods, tools, and guidance to support a harmonised approach to security management, ensuring alignment with the regulatory framework and international standards.
• Solve cyber security incidents,participatein crisis management activities, and ensure the organisation is prepared to handle emergencies effectively.
• Audit andmonitorthe effectiveness of security measures and service providers, ensuring compliance with internal policies and external regulations.
• Collaborate with internal teams on cyber security and serve as a subject matter expert to advise management and stakeholders on cyber security issues, including regulatory compliance and operational impact.
• Conduct security(risk)assessments, including critical supplier risk assessments, analysevulnerabilitiesandidentifysolutions and corrective actions, and report on findings.Conduct activities addressing fraudulent cyber activities affecting the Agency as well as stakeholders.
• Monitor and analyse the aviation cyber threat landscape, conduct cyber threat intelligence (CTI)analysesand produce CTI reports.
• Provide technical oversight on the effectiveness of cyber security related controls and tools andidentifypotential technical and procedural gaps for further development and/or enhancements.
• Develop the content of training programs and deliver courses providing guidance and support in cyber security. Develop and deliver security awareness related activities.
• Collaborate with internal and external partners,andparticipatetoevents, workshops,meetings, etcand projects to shareexpertiseand contribute to initiatives in cyber security.
• Produceand/or contribute totechnical documents to document analyses,findingsand recommendations.
• Contribute to tender specifications and evaluation of offers. Monitor contracts’ performance, identifyingissues and ensuring adherence to contractual requirements.
• Stay updated on latest technological developments/methods/best practices/trends and share them within the internal community to enhance organisational knowledge.
• Carry out any other task in line with the main purpose of the job.

Required qualifications, experience & competencies

• Completion of relevant third level studies (IT and/or security studies), meeting European Qualifications Framework (EQF) Level 6 followed by at least 4 years relevant professional experience to carry out the advertised responsibilities.
• Completion of relevant third level studies (IT and/or security studies) meeting EQF Level 7 followed by at least 3 years relevant professional experience to carry out the advertised responsibilities.
• Internal candidates can check on the intranet to see what level of in-house experience is considered equivalent to educational qualifications where appropriate.
• Experience in conducting cyber security risk assessments, including threat and vulnerability analysis, control evaluation, risk treatment definition, and reporting of findings.
• Experience in analysis of technical systems, applications, and architectures from a security and risk perspective, and identify weaknesses, attack paths, and mitigating controls.
• Knowledge of governance, risk and compliance frameworks, including the practical application of standards and regulatory requirements such as ISO 27001, NIST CSF (National Institute of Standards and Technology Cybersecurity framework), CIS (Center for Internet Security), or equivalent.
• Hands-on cyber security expertise in one or more cybersecurity domains such as penetration testing, incident response, secure coding or application security.
• Technical drafting skills in English.
• Quality focus: You set and foster high-quality standards.
• Influencing: You tailor style and approach to impact others.
• Problem solving: You anticipate and solve business issues.
• Communication: You are able to foster two-way communication.
• Analytical thinking: You analyse information and are able to identify relationships.
• Ability to work in a multinational and multicultural environment.
• Professional conduct in line with the corporate behaviours of the Agency, i.e. result-driven, readiness to change, customer focus, integrity and team-player approach.
• Applications will be accepted from nationals of EUROCONTROL Member States only.
• The selected candidate may be required to provide documentary evidence confirming they meet the minimum education requirements. They will be informed if and when specific evidence is needed. Please note that no offer (for external candidates) or appointment (for internal candidates) will be made until the necessary evidence, if required, is validated.
• The selected candidate will be appointed in accordance with the provisions of the General conditions of employment governing servants at the EUROCONTROL Maastricht Centre. This appointment may be renewed several times, but its total duration, including all renewal periods, may not exceed nine (9) years. A conversion to an undetermined duration appointment is possible where all of the following cumulative conditions are met: the post is confirmed as being of a lasting nature; the staff member has completed at least five years of service; the staff member’s performance has been satisfactory; and the conversion is in the interests of the service. Conversion is therefore not automatic.
• Conditions depending on current type of engagement
  Internal staff appointed for a determined period
  • Retain their current type of appointment duration.
  • Continue under their existing appointment duration, as appointment durations are not cumulative.
  • The duration of their appointment will therefore not restart upon selection to the new post, i.e. the remaining duration of their current determined appointment continues to apply.
  • Renewal(s): This appointment may be renewed several times, but its total duration, including all renewal periods, may not exceed nine (9) years.
  • Conversion: Conversion to an undetermined duration appointment is possible where all of the following cumulative conditions are met: the post is confirmed as being of a lasting nature; the staff member has completed at least five years of service; the staff member’s performance has been satisfactory; and the conversion is in the interests of the service. Conversion is therefore not automatic.
  Internal staff appointed for an undetermined period
  • Retain their current type of appointment duration.
  At the end of the 5 Year period of the post for which they were selected:
  • If the assignment is extended, they will continue in the post in accordance with the applicable rules.
  • If the assignment is not extended and/or the duties are not confirmed as being of a lasting nature, they will be transferred to another post corresponding to their “previous” type of post, job level, and function group.
• The selected candidate must successfully complete a probationary period of nine (9) months before being established in the post.
• The selected candidate shall be appointed at the grade set out in this vacancy notice, or if a group of grades has been published for a job level, in principle at the basic grade of the published job level.
• Candidates declared suitable who are not selected for the post will be placed on a reserve list for similar roles. The reserve list will be valid for one year from the closing date of applications.
• EUROCONTROL is an equal opportunities employer. We are committed to equality and diversity . In the event of equal merit, preference may be given to the applicant from the under-represented diversity characteristics in order to complement diversity of teams and rebalance the workforce.