OSCAL Architect (Security Controls as Code) for NATO with security clearance

WLG; Den Haag; On-site; EUR 90,000 - 120,000; Full time

Job summary

WLG in The Hague is seeking a Security Architect to translate written standards into a structured, machine-readable control catalogue. You will architect the translation from NIST/ISO baselines to policy-as-code and enable continuous compliance across cloud environments.

You will lead mapping of control triggers to identifiers, review evidence, and help generate the first full system security plan from automated data sources, working with stakeholders to validate mappings and remediation paths.

Qualifications

• Bachelor's degree with 3+ years of related experience.
• 3 years across NIST/ISO control frameworks, JSON and YAML, and regulatory mapping.
• Translating compliance requirements into code.
• Documented experience of process analysis and design.

Responsibilities

• Review existing security requirement statements and the baselines behind them.
• Import the baseline into a structured, machine-readable control format.
• Identify and document technical triggers for the cloud environment.
• Map those triggers to specific control identifiers — policy as code.
• Review sampled automated evidence for completeness, accuracy and fitness for a system security plan.
• Generate the first full system security plan from automated evidence, not by hand.
• Run stakeholder sessions to validate mappings, evidence sources and generation logic.
• Track issues through to remediation.

Skills

NIST & ISO control frameworks

JSON

YAML

Regulatory mapping

Translating compliance requirements

Education

Bachelor's degree in related discipline

Job description

A control catalogue written in prose cannot be checked by a machine. Your job would be to change that. A multinational defence organisation in The Hague, Netherlands is digitising its security control baseline so that compliance can be measured continuously rather than audited once a year. You would architect the translation — from written standards to structured, machine-readable control data.

What You Would Be Doing

• Reviewing the existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion
• Importing that baseline into a structured, machine-readable control format
• Identifying and documenting the technical triggers that the cloud environment can raise
• Mapping those triggers to specific control identifiers — policy as code
• Reviewing sampled automated evidence for completeness, accuracy and fitness to support a system security plan
• Generating the first full system security plan from automated evidence rather than by hand
• Running stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic
• Tracking issues through to remediation

What you would bring

• A bachelor's degree in a related discipline with three years of related experience
• Three years across all of: NIST and ISO control frameworks; confident JSON and YAML; and regulatory mapping
• Translating compliance requirements into code
• Documented experience of process analysis and design

Nice to have

• Real technical knowledge of how allied organisations achieve interoperability
• A working understanding of defence cloud strategy
• ITIL, COBIT or an equivalent

Why this one is worth a look

Very few architects have taken a real control catalogue all the way into code and out again as a generated security plan. This is that piece of work, on a serious estate.