Security Control Framework Engineer (Policy-as-Code and Automated SSP) for NATO with security clearance

Wlgroup; Den Haag; On-site; EUR 80,000 - 120,000; Full time

Job summary

Wlgroup in The Hague is seeking a security architect to translate written standards into structured, machine-readable control data. You will architect the translation—from NIST/ISO baselines to a policy-as-code model and align cloud triggers with control identifiers.

You will review evidence, generate the system security plan from automated sources, and lead stakeholder sessions to validate mappings and remediation steps.

Qualifications

• Bachelor's degree in a related discipline with three years of related experience.
• Three years across NIST and ISO control frameworks; JSON and YAML; and regulatory mapping.
• Translating compliance requirements into code.
• Documented experience of process analysis and design.

Responsibilities

• Review the existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion.
• Importing that baseline into a structured, machine-readable control format.
• Identifying and documenting the technical triggers that the cloud environment can raise.
• Mapping those triggers to specific control identifiers — policy as code.
• Reviewing sampled automated evidence for completeness, accuracy and fitness to support a system security plan.
• Generating the first full system security plan from automated evidence rather than by hand.
• Running stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic.
• Tracking issues through to remediation.

Skills

NIST/ISO frameworks

JSON

YAML

Regulatory mapping

Policy as code

Process analysis

Education

Bachelor's degree

Job description

A control catalogue written in prose cannot be checked by a machine. Your job would be to change that.

A multinational defence organisation in The Hague, Netherlands is digitising its security control baseline so that compliance can be measured continuously rather than audited once a year. You would architect the translation — from written standards to structured, machine-readable control data.

What you would be doing

• Reviewing the existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion
• Importing that baseline into a structured, machine-readable control format
• Identifying and documenting the technical triggers that the cloud environment can raise
• Mapping those triggers to specific control identifiers — policy as code
• Reviewing sampled automated evidence for completeness, accuracy and fitness to support a system security plan
• Generating the first full system security plan from automated evidence rather than by hand
• Running stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic
• Tracking issues through to remediation

What you would bring

• A bachelor's degree in a related discipline with three years of related experience
• Three years across all of: NIST and ISO control frameworks; confident JSON and YAML; and regulatory mapping
• Translating compliance requirements into code
• Documented experience of process analysis and design

Nice to have

• Real technical knowledge of how allied organisations achieve interoperability
• A working understanding of defence cloud strategy
• ITIL, COBIT or an equivalent

Why this one is worth a look

Very few architects have taken a real control catalogue all the way into code and out again as a generated security plan. This is that piece of work, on a serious estate.