Staff Cybersecurity Specialist – Incident Response (f/m/x)

Spektrum have a wide range of exciting opportunities in several global locations.  We are always looking to add great new talent to our team and look forward to hearing from you. Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects. ---------------------------------------------------------------------------------------------------------------------------------- Who we are supporting  The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium. The NCIA provides a wide range of services, including: * Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats. * Command and Control Systems: The NCIA develops and maintains the systems used by NATO's military commanders to plan and execute operations. * Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces. * Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks. * Information Management: The NCIA manages NATO's information technology infrastructure, including its databases, applications, and servers. Overall, the NCIA plays a critical role in ensuring the security and effectiveness of NATO's communication and information technology capabilities. The program Assistance and Advisory Service (AAS) The NATO Communications and Information Agency (NCI Agency) is NATO’s principal C3 capability deliverer and CIS service provider. It provides, maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV, and, when required, stand together in the face of attack under Article V. To provide these critical services, in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorise's: NATO International Civilians (NIC)'s, Military (Mil), and Interim Workforce Consultants (IWC)'s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce. Role ID –C004920 Role Background The Cyber Security Officer is responsible for designing, implementing, and maintaining cyber security solutions that protect the organization's information systems and infrastructure. The role supports secure system development, risk management, security operations, compliance activities, and incident response while leading a small Cyber Security and COMSEC team. The position works closely with stakeholders and the NATO Cyber Security Centre (NCSC) to ensure systems comply with NATO security policies and operational requirements. Role Duties and Responsibilities  Design, develop, implement, test, and maintain secure information systems throughout the system development lifecycle.  Develop cyber security solutions that meet operational and business requirements.  Work with stakeholders to translate business and functional requirements into secure technical solutions.  Apply and maintain security controls in accordance with organizational policies and local risk assessments.  Perform risk assessments for information systems and identify security risks.  Recommend security improvements and mitigation strategies for identified risks.  Define and maintain secure system configurations that comply with approved architectures.  Support the investigation of cyber security incidents, suspected attacks, and security breaches.  Lead and supervise a team of 3–4 Cyber Security and COMSEC personnel.  Manage Cyber Security operations as the Cyber Security Section Head.  Coordinate cyber security activities with the NATO Cyber Security Centre (NCSC).  Oversee boundary protection, data loss prevention, endpoint protection, and enterprise anti-malware solutions.  Plan, schedule, coordinate, and facilitate cyber security audits and inspections.  Manage corrective actions resulting from security audits and inspections.  Supervise security monitoring, testing, evaluation, and accreditation activities for information systems.  Plan and implement cyber security services to support Agency business units.  Deputize for senior staff when required.  Perform additional duties as assigned.  Support physical tasks, including lifting equipment up to 25 lbs when required. Essential Skills, Experience and Certifications  Strong knowledge of cyber security principles, system security, and security architecture.  Windows Server security hardening and compliance management.  Network security, firewall technologies, VPNs, intrusion detection, and forensic tools.  Security governance, risk management, and vulnerability management.  Security incident response and investigation.  Data Loss Prevention (DLP) and endpoint security management.  Security audit coordination and compliance management.  Server, network, and storage virtualization technologies.  Public Key Infrastructure (PKI).  Cloud technology fundamentals.  Strong analytical and problem-solving skills.  Ability to work independently and manage multiple priorities.  Excellent written and verbal communication skills.  Positive customer-focused attitude with strong interpersonal skills.  Ability to perform effectively in high-pressure environments.  Familiarity with ITIL service management processes.  Basic understanding of Disaster Recovery (DR) and Business Continuity (BC). Experience  Minimum 5 years' experience in Windows Server security hardening.  Minimum 3 years' experience with Trellix ePolicy Orchestrator and Trellix Endpoint Security (or equivalent endpoint security platform).  Minimum 2 years' experience in: o System security o Security architecture o Network security engineering o Security governance o Risk management  Experience with: o Windows Server 2016, 2019 and 2022 o Windows 10 and Windows 11 o Palo Alto Enterprise Firewalls o Trellix/McAfee Endpoint Security solutions o Vulnerability scanning tools such as Nessus o VMware vSphere, ESX, NSX and vSAN o Wireless LAN security o Mobile endpoint security o Supporting NATO Enterprise CIS environments  Previous experience working in an international military and civilian environment is desirable. Education  Bachelor's degree in Cyber Security, Information Technology, Computer Science, or a related discipline. OR  At least 6 years of extensive and progressive experience in a closely related cyber security role. Certifications Mandatory  CISM or CISSP Preferred  CGRC/CAP, CASP+, Cloud+, PenTest+, Security+, GSEC, CISA, CISSO, CPTE, CySA+, FITSP-A, GCSA, CISSP-ISSEP, GSLC, GSNA, CEH, GIAC certifications  ITIL Foundation (v3 or v4)  NATO COMPUSEC Practitioner Level 1 (0731)  NATO COMPUSEC Practitioner Level 2 (0732)  NATO CIS Security Officer (0280)   Language  English Level B2–C1 (NATO STANAG 6001 Level 3333). Working Location  Location: Ramstein, Germany  Work Arrangement: Full-time, primarily on-site  Remote work may be permitted only with prior Agency approval and project requirements.  Some physical duties may be required, including lifting up to 25 lbs. Working Policy  Employment Type: Full-time Contract  Contract Duration: 30 August 2026 – 30 December 2026  Weekly Working Hours: 38 hours per week  Working Days: Monday to Friday  Daily unpaid lunch break in accordance with local regulations.  Contractor must maintain valid personal liability and comprehensive insurance.  Must be available during agreed working hours.  Must comply with all Agency security, information assurance, and data protection policies.  Reliable communication and secure access to Agency systems are required throughout the assignment. Travel  Some travel to other NATO sites may be required Security Clearance  Valid NATO Cosmic Top Secret (CTS-A / COSMIC TOP SECRET ATOMAL) security clearance at the time of submission and throughout the contract. ----------------------------------------------------------------------------------------------------------------------------------   We never know what new opportunities might be just over the horizon. If this opportunity isn't for you, please feel free to send us your resume anyway and be the first to know if something suitable for your skills and experience comes up.

Spektrum have a wide range of exciting opportunities in several global locations.  We are always looking to add great new talent to our team and look forward to hearing from you. Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects. ---------------------------------------------------------------------------------------------------------------------------------- Who we are supporting  The NATO Joint Warfare Centre (JWC) is a NATO establishment focused on improving the Alliance's operational capabilities through training and exercises. Located in Stavanger, Norway, the JWC plays a critical role in preparing NATO forces for future challenges by: * Training and Exercises * Conducting large-scale, joint operational-level training events, simulations, and exercises to enhance interoperability among NATO member nations. * Doctrine Development * Contributing to the development and refinement of NATO doctrines and concepts by providing feedback and insights from exercises and training activities. * Operational Support * Offering expert support to NATO operations, missions, and exercises, ensuring that lessons learned are integrated into future training and planning.  The JWC supports NATO's overall strategic objectives by ensuring that its forces are well-prepared and capable of responding to various global threats and challenges. The program  To deliver each full exercise cycle the JWC relies heavily on an Exercise Control (EXCON) structure. EXCON staff members are drawn from several backgrounds and units including JWC staff, NATO component commands, Training Audience (TA) Headquarters, Partner Nations and other augmenters’ positions. EXCON has both direction and control functions which allow it to establish the conditions needed by the TA to achieve the exercise aim and objectives. EXCON size and structure is flexible and is shaped to the requirement of each phase of exercise delivery. When it is not possible to fill a position from military sources, the JWC has the option to source a contractor to fill a position. Not all contracted positions are required for each phase of each exercise. ---------------------------------------------------------------------------------------------------------------------------------- Role Background Opposition Force (OPFOR) SMEs simulate, coordinate and arrange all opposing actors during exercise execution. OPFOR SMEs ensure that OPFOR force composition, Joint Plan and Scheme of Manoeuvre are realistic and additionally mimic anticipated actions of an opposing force. OPFOR SMEs directly coordinate OPFOR concepts of operations to challenge allied-partner nation actions (BLUFOR) and associated major maritime, air and land formations, campaigns and decision making. OPFOR cells sit side-by-side with other functional areas in the scripting of content, to include JEMM and as required during execution, coordinate with EXCON RCs, to edit and adjust content to help guarantee maximum training value and pathway to achieve exercise-training objectives (TOs). OPFOR needs to ensure they understand BLUFOR plans and act accordingly and be prepared to dynamically scrip. Role Duties and Responsibilities Incident Development Workshop, MEL/MIL Workshops and Block E - Execution Phase: * Take part in/contribute to OPFOR CYBER incident and storyline development of OPFOR CYBER effects in the Joint Exercise Management Module (JEMM) and develop OPFOR CYBER effects at appropriate level and in accordance with and the overall OPFOR Joint Plan (OJP) and Scheme of Manoeuvre (SoM). * Ensure that all OPFOR CYBER incidents and injects in JEMM are focused on strategic and operational level effects (not tactical). * Support MEL/MIL Scripting, including JEMM, translating guidance from OPFOR command cell and OPFOR J35 into a deliverable plan and overseeing OPFOR CYBER operations across all Events, Incidents and Injects. * Actively support and advise assigned MEL/MIL workshop syndicate(s) on OPFOR CYBER implications related to incidents and injects and develop opportunities for OPFOR CYBER effects by contributing OPFOR CYBER expertise. * Specifically ensure wider understanding of OPFOR CYBER implications within events, incidents, storylines and themes and identify opportunities for OPFOR CYBER effects to be further developed and explored ICCW other Response Cells. * Coordinate, synchronize and de-conflict OPFOR CYBER injects in JEMM across the overall exercise battle rhythm with other OPFOR cells and other EXCON cells as required. * Specifically coordinate with EXCON CYBER Response Cell (RC) as required. * Contribute to the OPFOR Operational Design from a CYBER domain perspective. * Advise OPFOR command cell and OPFOR J35 in cyber warfare. * Brief the OPFOR CYBER team on the cyberspace package (i.e. Cyber threat actors, their TTPs etc.) as required. * Attend boards, working groups, syndicates and other meetings as directed by OPFOR command cell and OPFOR J35. * Be prepared to attend OPFOR Crisis Action Team (CAT) activation at short notice or no notice in order support resolution of a critical exercise related issue. * Coordinate CAX (Computer Assisted Exercise) and Joint Theatre Level Simulation (JTLS) requirements for OPFOR CYBER actions. * Perform other OPFOR CYBER tasks as directed by the OPFOR command cell OPFOR J35. Execution (Block E): * Collaborate daily with OPFOR command cell and OPFOR J35 to ensure timely alignment with the latest OPFOR developments as directed by the OPFOR command cell and OPFOR J35. * Assist with the preparation of OPFOR FRAGOs. * Provide daily OPFOR CYBER feedback and updates to the OPFOR command cell and OPFOR J35 as required. BPT brief specific OPFOR CYBER issues at the daily OPFOR Huddle * Provide support to EXCON Targeting (TGTs) cell for Battle Damage Assessment (BDA) reporting. * Be prepared to dynamically script, in JEMM, OPFOR CYBER content as required by the MEL/MIL, TA activity, OPFOR command cell and OPFOR J35 D&G. Essential Skills and Experience * Minimum 4 years previous military experience within the last 12 years in the operational CYBER domain, reaching the rank of OF3/OF4 (suitably experienced OF2/OR7+ considered by exception based on expertise and relevant staff experience) * In-depth knowledge and understanding of NATO’s CYBERSPACE operations Operational Planning Procedures and Processes * Experience of NATO or National Operational Exercises Education * Higher-level Civilian, Military or Staff College Education/Degree or advanced military course relevant to cybersecurity, computer science or a similar discipline Language * Business English Working Location * Stavanger, Norway Working Policy * On-Site Travel * Some travel to other NATO sites may be required Security Clearance * Valid National or NATO Secret personal security clearance We never know what new opportunities might be just over the horizon. If this opportunity isn't for you, please feel free to send us your resume anyway and be the first to know if something suitable for your skills and experience comes up.