Web Application Security Assessment Consultant
Spektrum have a wide range of exciting opportunities in several global locations.
We are always looking to add great new talent to our team and look forward to hearing from you.
Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.
Who we are supporting
The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium.
The NCIA provides a wide range of services, including:
* Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats.
* Command and Control Systems: The NCIA develops and maintains the systems used by NATO's military commanders to plan and execute operations.
* Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
* Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks.
* Information Management: The NCIA manages NATO's information technology infrastructure, including its databases, applications, and servers.
Overall, the NCIA plays a critical role in ensuring the security and effectiveness of NATO's communication and information technology capabilities.
The program
Assistance and Advisory Service (AAS)
The NATO Communications and Information Agency (NCI Agency) is NATO’s principal C3 capability deliverer and CIS service provider. It provides, maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV, and, when required, stand together in the face of attack under Article V.
To provide these critical services, in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorise's: NATO International Civilians (NIC)'s, Military (Mil), and Interim Workforce Consultants (IWC)'s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce.
Role ID – 2024-0315
Role Background
For more than 70 years, NATO’s mission has been to preserve peace and security in the Alliance for nearly one billion citizens.
The NATO Communications and Information Agency (NCIA) and its predecessors have worked tirelessly in providing the means that enable the connectedness and togetherness that keep our Alliance strong.
Our technology and cyber experts allow NATO to conduct critical operations, protect NATO’s airspace, make data-driven decisions, defend against cyber-attacks, secure NATO networks and maintain superiority in space.
Role Duties and Responsibilities
* Black box testing: Results are published on the dedicated portal when they are found – contractor must monitor the portal at least once a day. In reality an email notification mechanism is available.
* Once the new vulnerability is found, appropriate technical POC’s must be contacted. Depending on the severity it must be done immediately or on the weekly basis.
* Grey box testing are performed according to the planned schedule. Once the assessment is finished there is an assessment report released.
* Must review and validate the discovered vulnerabilities and their severity.
* On every assessment report must prepare remediation plan and provide it the appropriate technical POC.
* Progress on the remediation plans for all sites must be verified at least once a week. Work might need to be performed in parallel for different sites. Remediation plan and dashboards need to be updated as soon as we have updates from the involved parties.
* Communication is often used on Internal NATO Systems, therefore the Contractor must work onsite (Mons Office) to be able to check.
* Keep and maintain WASA inventory sheet with all stakeholders’ information for all sites.
* Once a week contractor takes part in the progress meeting with the stakeholders (OCIO). Contactor maintains the dashboards and spreadsheets reflecting the current status of the remediation activities for all the active assessment campaigns.
* Once a month contactor is preparing the presentation and briefs at the Enterprise Vulnerability Assessment Plan (EVAP). It is a program under OCIO supervision.
* Track and trace other vulnerabilities provided from different sources if those vulnerabilities are related to the scope of the Web Application Security Assessment (WASA) campaign.
* Meetings with stakeholders in Brussels (this type of activity may occur max 1 per month)
Essential Skills, Experience and Certifications
* + 5 years of experience in web applications assessment, with proven experience within the last 6 months.
* General knowledge of cyber security principles, best practices, concepts and technology;
* Knowledge of cyber security architectures, including boundary protection, encryption, identity and access management, monitoring and detection, incidence response, vulnerability assessments, and risk management;
* + 3 years of experience in testing and validating that contracted deliveries meet the security requirements and fulfil the intended use-cases;
* Familiarity with NATO security policy and supporting directives is desirable.
* Knowledge of Web Application Security Assessment (WASA) environment
* Ability to work independently and in teams to achieve the desired goals.
* The ability to take ownership of tasks and strong motivation to accomplish them to the end.
* Excellent communications and writing skills in English.
Working Location
Working Policy
* On-site
Travel
* Some travel to other NATO sites may be required
Security Clearance
* Valid National or NATO Secret personal security clearance
We never know what new opportunities might be just over the horizon. If this opportunity isn't for you please feel free to send us your resume anyway and be the first to know if something suitable for your skills and experience comes up.
Apply for this job
*
indicates a required field
First Name *
Last Name *
Email *
Phone *
Resume/CV *
Enter manually
Accepted file types: pdf, doc, docx, txt, rtf
Please provide your LinkedIn Profile address?
Provide your LinkedIn URL address for your profile, if you have one
What is your Nationality/Citizenship status from the below list? * Select...
Due to the mandatory requirements from our clients, there can be Nationality/Citizenship requirements, for the role you are applying for, the following nationality restrictions may apply:
Do you hold a second Nationality/Citizenship in addition to the one that you identified previously? * Select...
Some of our clients have restrictions regarding dual nationality citizens which restrict employment
If you identified "Other" as a Nationality/Citizenship status, please identify which country is this?
This response is only required if you have identified "Other" for either the primary/secondary Nationality/Citizenship status questions
What is your current notice period from your existing employer * Select...
How much time would you have to contractually or prefer to provide your existing employer when leaving your current role
Do you currently hold a Personal Security Clearance (PSC)? * Select...
If the advertised role identifies that a PSC is required then this must be available at time of application for the role. Information for what is a Personal Security Clearance (PSC) can be found at the link below:
What is your current Personal Security Clearance (PSC) level to the best of your knowledge? *
A national only PSC does not prevent you from applying for roles which require NATO or EU PSC.
#J-18808-Ljbffr