Compliance-as-Code Architect (NISTISO, JSON and YAML) for NATO with security clearance

A control catalogue written in prose cannot be checked by a machine. Yourjob would be to change that.

A multinational defence organisation in The Hague Netherlands is digitising its securitycontrol baseline so that compliance can be measured continuously rather than audited once a would architect the translation from written standards to structured machine-readablecontrol data.

What you would be doing

• Reviewing the existing security requirement statements and the NIST or ISO baseline behindthem ready for conversion
• Importing that baseline into a structured machine-readable control format
• Identifying and documenting the technical triggers that the cloud environment can raise
• Mapping those triggers to specific control identifiers policy as code
• Reviewing sampled automated evidence for completeness accuracy and fitness to support asystem security plan
• Generating the first full system security plan from automated evidence rather than byhand
• Running stakeholder sessions to validate the assumptions mappings evidence sources and thegeneration logic
• Tracking issues through to remediation

What you would bring

• A bachelors degree in a related discipline with three years of related experience
• Three years across all of: NIST and ISO control frameworks; confident JSON and YAML; andregulatory mapping
• Translating compliance requirements into code
• Documented experience of process analysis and design

Nice to have

• Real technical knowledge of how allied organisations achieve interoperability
• A working understanding of defence cloud strategy
• ITIL COBIT or an equivalent

Why this one is worth a look

Very few architects have taken a real control catalogue all the way into code and out again asa generated security plan. This is that piece of work on a serious estate.