Web Application Security Assessment Consultant

Spektrum supports apex purchasers (NATO UN EU and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services specialised aerospace and defence sales delivery and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.

Who we are supporting

The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATOs member countries and its partners. The agency was established in 2012 and is headquartered in Brussels Belgium.

The NCIA provides a wide range of services including:

• Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATOs communication networks and information systems against cyber threats.
• Command and Control Systems: The NCIA develops and maintains the systems used by NATOs military commanders to plan and execute operations.
• Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
• Electronic Warfare: The NCIA provides electronic warfare services to support NATOs mission to detect deny and defeat threats to its communication networks.
• Information Management: The NCIA manages NATOs information technology infrastructure including its databases applications and servers.

Overall the NCIA plays a critical role in ensuring the security and effectiveness of NATOs communication and information technology capabilities.

The program

Assistance and Advisory Service (AAS)

The NATO Communications and Information Agency (NCI Agency) is NATOs principal C3 capability deliverer and CIS service provider. It provides maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV and when required stand together in the face of attack under Article V.

To provide these critical services in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorises: NATO International Civilians (NIC)s Military (Mil) and Interim Workforce Consultants (IWC)s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce.

Role ID 2024-0315

Role Background

For more than 70 years NATOs mission has been to preserve peace and security in the Alliance for nearly one billion citizens.

The NATO Communications and Information Agency (NCIA) and its predecessors have worked tirelessly in providing the means that enable the connectedness and togetherness that keep our Alliance strong.

Our technology and cyber experts allow NATO to conduct critical operations protect NATOs airspace make data-driven decisions defend against cyber-attacks secure NATO networks and maintain superiority in space.

Role Duties and Responsibilities

• Black box testing: Results are published on the dedicated portal when they are found contractor must monitor the portal at least once a day. In reality an email notification mechanism is available.
• Once the new vulnerability is found appropriate technical POCs must be contacted. Depending on the severity it must be done immediately or on the weekly basis.
• Grey box testing are performed according to the planned schedule. Once the assessment is finished there is an assessment report released.
• Must review and validate the discovered vulnerabilities and their severity.
• On every assessment report must prepare remediation plan and provide it the appropriate technical POC.
• Progress on the remediation plans for all sites must be verified at least once a week. Work might need to be performed in parallel for different sites. Remediation plan and dashboards need to be updated as soon as we have updates from the involved parties.
• Communication is often used on Internal NATO Systems therefore the Contractor must work onsite (Mons Office) to be able to check.
• Keep and maintain WASA inventory sheet with all stakeholders information for all sites.
• Once a week contractor takes part in the progress meeting with the stakeholders (OCIO). Contactor maintains the dashboards and spreadsheets reflecting the current status of the remediation activities for all the active assessment campaigns.
• Once a month contactor is preparing the presentation and briefs at the Enterprise Vulnerability Assessment Plan (EVAP). It is a program under OCIO supervision.
• Track and trace other vulnerabilities provided from different sources if those vulnerabilities are related to the scope of the Web Application Security Assessment (WASA) campaign.
• Meetings with stakeholders in Brussels (this type of activity may occur max 1 per month)

Essential Skills Experience and Certifications

• 5 years of experience in web applications assessment with proven experience within the last 6 months.
• General knowledge of cyber security principles best practices concepts and technology;
• Knowledge of cyber security architectures including boundary protection encryption identity and access management monitoring and detection incidence response vulnerability assessments and risk management;
• 3 years of experience in testing and validating that contracted deliveries meet the security requirements and fulfil the intended use-cases;
• Familiarity with NATO security policy and supporting directives is desirable.
• Knowledge of Web Application Security Assessment (WASA) environment
• Ability to work independently and in teams to achieve the desired goals.
• The ability to take ownership of tasks and strong motivation to accomplish them to the end.
• Excellent communications and writing skills in English.

Working Location

• Mons Belgium

Working Policy

• On-site

Travel

• Some travel to other NATO sites may be required

Security Clearance

• Valid National or NATO Secret personal security clearance