Policy-as-Code Architect: Automated SSP & Controls

Wlgroup; Den Haag; On-site; EUR 80,000 - 120,000; Full time

Job summary

Wlgroup in The Hague is seeking a security architect to translate written standards into structured, machine-readable control data. You will architect the translation—from NIST/ISO baselines to a policy-as-code model and align cloud triggers with control identifiers.

You will review evidence, generate the system security plan from automated sources, and lead stakeholder sessions to validate mappings and remediation steps.

Qualifications

• Bachelor's degree in a related discipline with three years of related experience.
• Three years across NIST and ISO control frameworks; JSON and YAML; and regulatory mapping.
• Translating compliance requirements into code.
• Documented experience of process analysis and design.

Responsibilities

• Review the existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion.
• Importing that baseline into a structured, machine-readable control format.
• Identifying and documenting the technical triggers that the cloud environment can raise.
• Mapping those triggers to specific control identifiers — policy as code.
• Reviewing sampled automated evidence for completeness, accuracy and fitness to support a system security plan.
• Generating the first full system security plan from automated evidence rather than by hand.
• Running stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic.
• Tracking issues through to remediation.

Skills

NIST/ISO frameworks

JSON

YAML

Regulatory mapping

Policy as code

Process analysis

Education

Bachelor's degree

Job description

Wlgroup in The Hague is seeking a security architect to translate written standards into structured, machine-readable control data. You will architect the translation—from NIST/ISO baselines to a policy-as-code model and align cloud triggers with control identifiers.

You will review evidence, generate the system security plan from automated sources, and lead stakeholder sessions to validate mappings and remediation steps.