OSCAL Architect: Turning Standards into Code‑Driven Plans

Wlgroup; Den Haag; On-site; EUR 70,000 - 110,000; Full time

Job summary

Wlgroup in The Hague, Netherlands, is digitising its security control baseline to measure compliance continuously. You would architect the translation from written standards to structured, machine-readable control data.

You will review baselines, import into machine-readable format, map cloud triggers to control IDs, generate the first full system security plan from automated evidence, and lead stakeholder sessions to validate mappings and evidence sources.

Qualifications

• Bachelor's degree in a related discipline with three years of related experience.
• Three years across NIST/ISO control frameworks; JSON and YAML; and regulatory mapping.
• Translating compliance requirements into code.
• Documented experience of process analysis and design.

Responsibilities

• Review existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion.
• Import that baseline into a structured, machine-readable control format.
• Identify and document the technical triggers that the cloud environment can raise.
• Map those triggers to specific control identifiers — policy as code.
• Review sampled automated evidence for completeness, accuracy and fitness to support a system security plan.
• Generate the first full system security plan from automated evidence rather than by hand.
• Run stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic.
• Tracking issues through to remediation.

Skills

NIST & ISO control frameworks

JSON

YAML

Regulatory mapping

Translating compliance to code

Process analysis & design

Policy as code

Education

Bachelor's degree in a related discipline

Job description

Wlgroup in The Hague, Netherlands, is digitising its security control baseline to measure compliance continuously. You would architect the translation from written standards to structured, machine-readable control data.

You will review baselines, import into machine-readable format, map cloud triggers to control IDs, generate the first full system security plan from automated evidence, and lead stakeholder sessions to validate mappings and evidence sources.