Cloud Risk and Compliance Lead (Audit Readiness) for NATO with security clearance

Automated evidence is worthless until an auditor accepts it. This post isabout making that case properly.

A multinational defence organisation in The Hague Netherlands is piloting continuousassurance over its cloud estate. You would lead the governance side of that pilot: define ittest whether the evidence really holds and show the leadership what it means.

What you would be doing

• Running the stakeholder discussion that fixes the pilots scope target environment priorityapplication success criteria and risk areas
• Agreeing roles responsibilities dependencies and decision points with the cloudcompliance audit and business sides
• Judging whether automated evidence from cloud and software services is complete reliabletraceable and fit for purpose
• Mapping that digital evidence to the controls audit requirements and assurance expectationsit is supposed to satisfy
• Reviewing the dashboard so that it reflects live risk control status and compliance ratherthan a comfortable picture
• Preparing the demonstration that explains the dashboard the insights and the business valueto an executive audience
• Running review sessions to validate assumptions and mappings and tracking issues toremediation

What you would bring

• A bachelors degree in a related discipline with three years of related experience
• Three years across all of: leadership; communication; strategy; risk management; auditstandards; and building a return-on-investment case people can follow
• Documented experience of process analysis and design

Nice to have

• Real technical knowledge of how allied organisations achieve interoperability
• A working understanding of defence cloud strategy
• ITIL COBIT or an equivalent

Why this one is worth a look

It is the rare governance post with a technical spine: you would be judging real automatedevidence not writing policy about it.