2025-0235 CIS Security Accreditation Support Engineer (NS) - MON 28 Jul

Deadline Date: Friday 25 July 2025

Requirement: CIS Security Accreditation Support Engineer

Location: Brussels BE

Full Time On-Site: Yes

Time On-Site: 100%

Period of Performance: 2025 BASE: As soon as possible not later than 01 September 2025 (tentative) 22 December 2025 with possibility of the following options thereafter:

2026 Option: 1 January 2026 until 31 December 2026

2027 Option: 1 January 2027 until 31 December 2027

2028 Option: 1 January 2028 until 31 December 2028

Required Security Clearance: NATO SECRET

1 INTRODUCTION

NCIA requires the provision of CIS Security Accreditation Engineer services for all the activities as defined in the following sections. For the 2025 Base Services activities will be conducted within and in support of an ongoing NHQ Accreditation project.

NCIA Coherence Branch

Within the Agency CIS Support Unit (CSU) Brussels provides consistent reliable and cost-effective ICT service delivery to all NATO customers located in the NATO compound in Brussels including understanding and managing the interface with the Secretary General and Deputy Director General International Military Staff (DG IMS) through his/her delegated representatives ICTM/EXCO IMS who act in the role of Intelligent Customer.

The Coherence (COH) supports the Agencys Demand Management (DM) organization and is responsible for liaison with all customers in the CSUs AoR and supports the Commander CSU in the role as NCIA representative and provides a single entry point for customers. Service Management Branch (SMB) contributes and/or conducts monitoring and measurement of customer satisfaction. SMB supports the management of all agreements concerning Service Provision Operations and Exercises within the CSU AoR. SMB supports Service Lines in the implementation and improvement of service management processes.

NCIA Service Design and CIS Security

Service Design and CIS Security (SDCS) team consists of subject matter experts mainly providing security compliance risk assessment risk management and security architecture services.

2 OBJECTIVES

The main objectives of this statement of work can be summarized as follows:

Support to organize coordinate and perform CIS security compliance and verification activities;

Support CIS security accreditation activities and remediation tasks;

Support and participate high-level multi-stakeholder CIS security related meetings and forums.

3 SCOPE OF WORK

Under the direction / guidance of the CIS Security Manager the services provided will be supporting the following activities:

1) CIS Security Services

a) Collaborate with internal and external auditors to understand security audit results and identify critical vulnerabilities.

b) Develop comprehensive remediation strategies including timelines resource allocation and responsible parties.

c) Prioritize remediation efforts based on risk assessments and business impact.

d) Coordinate with IT security and business units to ensure alignment and efficient execution of remediation activities.

e) Monitor the status of remediation efforts providing regular updates to senior management and stakeholders.

f) Ensure that remediation activities are completed within the established timelines and meet quality standards.

g) Maintain detailed records of remediation activities and outcomes.

h) Ensure that all remediation activities align with relevant security frameworks and regulatory requirements.

i) Support the development and implementation of IT risk management strategies.

j) Review and evaluate organizations CIS security policies and procedures to ensure they align with organizational goals and compliance requirements.

2) Continuous Improvement:

a) Identify areas for improvement in documentation and processes.

b) Proactively identify potential vulnerabilities and coordinate preventive measures.

c) Contribute to the knowledge base for SDCS team.

d) Ensure information is accurate and up-to-date.

3) Collaboration with IT Teams:

a) Work closely with other CSU Brussels IT teams and other NHQ/NCIA/Enterprise stakeholders to ensure CIS security compliance

b) Collaborate on projects and initiatives

c) Participate in CIS forums and discussions.

It is expected that ONE resource is providing the above services.

The contractor will provide the service on-site and there is a possibility to work 1 day per week teleworking from Belgium providing services during NATO HQ working hours.

The measurement of execution for this service is sprints with each sprint planned for a duration of 1 week.

The content and scope of each sprint will be agreed in writing during the sprint-planning meeting based on the activities mentioned above.

4 DELIVERABLES AND PAYMENT MILESTONES

The following deliverables are expected from the service on this statement of work:

2025 BASE: As soon as possible not later than 01 September 2025 to 31 December 2025:

Deliverable: 20 Sprints of Provision of CIS Security Services Contractor (Number of sprints is estimated. This will be adjusted based on actual starting date.)

Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) (Annex B) signed for acceptance by the Purchasers authorized point of contact and the Contractor

Subject on actual requirements contractor performance and available funding the Purchaser reserves the right to exercise optional sprints for 2025 at a later time within the same scope and cost.

The payment shall be dependent upon successful acceptance of the Delivery Acceptance Sheet (DAS) (Annex B) including the EBA Receipt number.

Invoices shall be accompanied with a DAS signed by the Contractor and Purchasers authority.

2026 OPTION: 01 January 2026 to 31 December 2026:

Deliverable: 46 Sprints of Provision of CIS Security Services Contractor (Number of sprints is estimated. This will be adjusted based on actual starting date.)

Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in COAAS Special Provisions article 6.5.

Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) (Annex B) signed for acceptance by the Purchasers authorized point of contact and the Contractor

Subject on actual requirements contractor performance and available funding the Purchaser reserves the right to exercise optional sprints for 2026 at a later time within the same scope and cost.

The payment shall be dependent upon successful acceptance of the Delivery Acceptance Sheet (DAS) (Annex B) including the EBA Receipt number.

Invoices shall be accompanied with a DAS signed by the Contractor and Purchasers authority.

2027 OPTION: 01 January 2027 to 31 December 2027:

Deliverable: 46 Sprints of Provision of CIS Security Services Contractor (Number of sprints is estimated. This will be adjusted based on actual starting date.)

Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in COAAS Special Provisions article 6.5.

Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) (Annex B) signed for acceptance by the Purchasers authorized point of contact and the Contractor

Subject on actual requirements contractor performance and available funding the Purchaser reserves the right to exercise optional sprints for 2026 at a later time within the same scope and cost.

The payment shall be dependent upon successful acceptance of the Delivery Acceptance Sheet (DAS) (Annex B) including the EBA Receipt number.

Invoices shall be accompanied with a DAS signed by the Contractor and Purchasers authority.

2028 OPTION: 01 January 2028 to 31 December 2028:

Deliverable: 46 Sprints of Provision of CIS Security Services Contractor (Number of sprints is estimated. This will be adjusted based on actual starting date.)

Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in COAAS Special Provisions article 6.5.

Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) (Annex B) signed for acceptance by the Purchasers authorized point of contact and the Contractor

Subject on actual requirements contractor performance and available funding the Purchaser reserves the right to exercise optional sprints for 2026 at a later time within the same scope and cost.

The payment shall be dependent upon successful acceptance of the Delivery Acceptance Sheet (DAS) (Annex B) including the EBA Receipt number.

Invoices shall be accompanied with a DAS signed by the Contractor and Purchasers authority.

5 COORDINATION AND REPORTING

The contractor shall participate in weekly status update meetings activity planning and other meetings as instructed physically in the office or in person via electronic means using Conference Call capabilities according to the Team Leaders instructions.

For each sprint to be considered as complete and payable the contractor must report the outcome of his/her service during the sprint first verbally during the retrospective meeting and then in written within three (3) days after the sprints end date. The format of this report shall be a short email to the NCIA Point of Contact mentioning briefly the service held and the development achievements during the sprint.

6 SCHEDULE

This task order will be active immediately after signing of the contract by both parties

It is expected the service starts as soon as possible but no later than 01 September 2025 and ending no later than 22nd December 2025.

If the 2026 option is exercised the period of performance is 01 st January 2026 to 31 st December 2026.

If the 2027 option is exercised the period of performance is 01 st January 2027 to 31 st December 2027.

If the 2028 option is exercised the period of performance is 01 st January 2028 to 31 st December 2028.

7 CONSTRAINTS

All the deliverables provided under this statement of work will be based on NCIA templates or agreed with the project point of contact.

8 SECURITY

The services provided by the proposed resource require a valid NATO SECRET security clearance.

9 PRACTICAL ARRANGEMENTS

The contractor will be required to provide the service primarily on-site at NATO Headquarters Brussels Belgium as part of this engagement. There is a possibility to work 1 day per week teleworking from Belgium.

This service must be accomplished by ONE contractor.

This individual providing services under this SOW will be part of the NCIA Service Delivery and CIS Security (SD&CS) team.

10 QUALIFICATIONS

See Requirements

8 SECURITY

• The services provided by the proposed resource require a valid NATO SECRET security clearance.

10 QUALIFICATIONS

The consultancy support for this service requires a CIS Security Accreditation Support Engineer with the following qualifications:

1) Essential qualifications

• Bachelors or Masters Degree in Cybersecurity Information Technology Computer Science Risk Management or a related field.
• Minimum of 5 years of experience in information security risk management or IT audit roles.
• Experience and knowledge in cyber security frameworks.
• Experience and knowledge in cybersecurity audit reports analysis.
• In-depth understanding of cybersecurity technologies and tools.
• Strong ability to communicate complex security issues to both technical and non-technical audiences.
• Proficiency in managing and coordinating demonstrating skills in team building and guidance.
• Preparing and delivering presentations to stakeholders in different forums.
• Ability to engage with technical teams comprehend challenges and provide informed guidance.
• Skilled in planning executing and overseeing technical CIS activities.
• Experience and knowledge in level of effort estimation to remediate the findings of an audit.
• Experience and knowledge in coordinating remediation and/or mitigation activities.
• Experience and knowledge on drafting remediation plans and maintaining them.
• Strong analytical skills to assess technical issues identify root causes and implement effective solutions.
• General experience on complex enterprise networks with multiple stakeholders and a diverse user community.
• General experience in all lifecycle aspects of Communication Information Systems (CIS) aimed at achieving effective system development and deployment.
• Sound technical knowledge on wide area networks and local area networks.
• Experience in developing technical policy level documents; in CIS and in services management.

2) Desirable qualifications:

• Previous work experience in international organizations such as NATO or specialized Defence Industry
• Knowledge of NATO CIS Security Policy Directive and Guidance
• Knowledge of NATO CIS Security Accreditation Process
• ITIL Certification
• Project Management certification.