CDT-0030 Expert on Defensive Cyberspace Operations Management (NS) - WED 18 Nov

Deadline Date: Wednesday 18 November 2026

Requirement: Expert on Defensive Cyberspace Operations Management DSO

Location: Mons, BE

Full Time On-Site: Yes

Total Scope of the request (hours): 1672 hrs (Estimate)

Required Start Date: 4 January 2027

End Contract Date: 31 December 2027

Required Security Clearance: NATO SECRET

Note: For all Level-of-Effort and Completion-Type requests processed outside of the IWC Value Stream, and for which the contractor will not be reimbursed directly by CDT for travel expenses, additional travel funding shall be allocated on a Not-to-exceed basis when the yearly Option is exercised.

Special Terms and Conditions: The contractor will be responsible for complying with the respective national requirements for working permits, visas, taxes, social security etc. whilst working on site at NATO HQ Brussels, Belgium. No special status is either conferred or implied by the host organisation, NATO HQ Brussels, Belgium to the contractor whilst working on site.

1. INTRODUCTION

The NATO Cyber and Digital Transformation (CDT) Division brings Information and Communications Technology (ICT) coherence across NATO Enterprise’s civil and military bodies. CDT is empowered to realize the Allies’ vision for the NATO Enterprise, is accountable to the Secretary General and is responsible for the development of Enterprise directives and advice on the acquisition and use of information technologies and services.

CDT also provides Enterprise oversight on cybersecurity issues, and, in close coordination with all relevant NATO civil and military bodies, works towards the continual improvement of the cyber hygiene and cybersecurity posture in the NATO Enterprise.

CDT is an integrated staff organization comprised of International Staff (IS) and International Military Staff (IMS) members.

CDT supports the planning, coordination and execution of Defensive Cyberspace Operations (DCO) in NATO networks, as one of the leading members of the DCO Planning and Coordination Cell (DPCC).

The incumbent will be responsible for ensuring appropriate coordination amongst the DPCC members (i.e. NATO Cyberspace Operations Centre (CyOC), Joint Intelligence and Security Division (JISD), NATO Communications and Information Agency (NCIA) and CDT). S/He will also be responsible for managing the complete lifecycle of DCOs led by the CDT, including the planning, conduct, assessment, and follow-up phases.

The incumbent must demonstrate in-depth knowledge of advanced technical operations in defence of communication and information systems, but also good knowledge in cyber incident management and cyber risk management best practices and processes.

2. TASKS

The contractor will effectively and efficiently provide, with minimal support, the following services:

• Plan, coordinate and oversee advanced technical DCO, incorporating activities such as threat hunting activities, adversary emulation and deception technologies;
• Draft clear and concise technical and non-technical reports;
• Working with NATO SMEs, develop relevant red and blue pictures in support of developing DCO plans;
• Develop DCO plans, supporting processes and procedures;
• Develop effective and actionable remediation plans based on lessons identified captured through DCO execution;
• Prepare and deliver presentations to technical and non-technical audiences, in order to facilitate consensus building and decision-making;
• Coordinate the work of the DPCC, ensuring appropriate communication and cooperation amongst the relevant NATO Enterprise stakeholders;
• Support the DPCC meetings, in working level and principals level format, facilitating discussions, leading CDT initiatives and providing advice during the DCO lifecycle;
• Liaise with CyOC, NCIA and other stakeholders for the planning and coordination of any cyberspace activities in the context of DCOs;
• Support the NATO Enterprise Incident Manager in the coordination and assessment of cybersecurity incident response activities in relation to ongoing DCOs;
• Support the risk management and decision making processes, coordinating with the NATO Cyber Risk Management Group (CRMG) and the NATO Board of CISOA (BCISOA).

3. PROFILE

[See Requirements]

4. LOCATION OF DUTY

The work will be executed primarily on site at the NATO SHAPE facility in Mons, Belgium.

The contractor is expected to work 5 days a week on site and may perform in specific (but very limited in frequency) situations teleworking at his residence in Belgium, following a security assessment of the place. No teleworking is allowed outside of the respective residence in Belgium.

Frequent travels or short deployments to NATO Command Structure bodies, including NATO HQ offices in Brussels, may also be required.

5. TIMELINES

The services of the contractor are required for the period starting 4th January 2027 until 31th December 2027.

A contract extension is possible for the calendar year 2028. The contract extension will be subject to performance of the contractor and related NATO regulations and budget availability.

6. SPECIFIC WORKING CONDITIONS

Secure environment with standard working hours. Occasional non-standard hours may be required in support of CDT urgent tasks.

7. TRAVEL

Occasional business travel may be required. Travel expenses will be reimbursed to the individual directly (in addition to the hourly rate) under NATO rules. Travel to NATO HQ offices in Brussels will not be reimbursed.

8. SECURITY AND NON-DISCLOSURE AGREEMENT

The contractor must be in possession or capable of possessing a security clearance of NATO SECRET.

A signed Non-Disclosure Agreement will be required.

Requirements

3. PROFILE

• The contractor must have more than 2 years of direct experience in defensive cyberspace operations focusing on the planning and conducting operations in military focused environments encompassing activities such as advanced technical operations, incident response, threat hunting, adversary emulation, etc.
• The contractor must have a minimum of 3 years proven project management experience working with different organizations within a federated environment in the coordination of planning, execution and technical remediation activities;
• The contractor must have excellent communication and negotiation skills;
• The contractor must have excellent English writing skills, the ability to draft clear and concise reports, and the ability to brief on their work in English;
• The contractor must have good knowledge of the principles, policy and procedures governing cybersecurity, preferably in military and/or defence organizations;
• Previous NATO experience in one or more of the fields of cybersecurity, cyber defence, cyberspace operations, cyber risk management or cyber incident management is desirable;
• Cyber security certifications such as CISM, CISSP or equivalent post-graduate degree in cybersecurity are desirable;

8. SECURITY AND NON-DISCLOSURE AGREEMENT

• The contractor must be in possession or capable of possessing a security clearance of NATO SECRET.