C005302 Cyber Security Incident Responder (NS) BELGIUM - 14 Sep

Deadline Date: Monday 14 September 2026



Requirement:   Cyber Security Incident Responder



Location: Mons, BELGIUM



Full Time On-Site: Yes



Time On-Site: 100%



Not to Exceed Rate: 71 EUR



Total Scope of the request (hours): 395



Required Start Date: 20 October 2026



End Contract Date: 31 December 2026



Required Security Clearance: NATO SECRET


Please do NOT apply for any NATO contract positions unless you meet ALL the following criteria:

1. Current National or NATO SECRET clearance
2. Nationality of one of the NATO member countries
3. Current work visa for the specific location if applying for an in-country position

Any applications that do NOT meet all the above - and do not CLEARLY show these on the CV - will be deleted.



Duties & Role:



Under the direction of the Section Head of the CSIRT, the contractor shall:

• Provision 24/7 Cyber Security Incident Response (Triage, Contain, Eradicate, Recover) activities, during normal working hours and occasional on-call duties, including weekends and holidays
• Deliver technical coordination, support, and assistance in respect of Cyber Security Incident Response to NATO CIS Operating Authorities, including but not limited to: NATO Nations, Partner Nations, non-Governmental Organisations and Industry Partners.
• Lead, be a member of, or support Cyber Security Response Teams designated to extend the NCSC Incident Response coverage to one or multiple physical locations, including within the NATO Alliance Operations and Missions.
• Build, manage the lifecycle of, and maintain the taxonomy related to the Branch's information.
• Manage the content of different information portals within the agreed taxonomy.
• Design, create and distribute a variety of reports, briefings and dashboards, to different communities, including: (Business owners, operational community, IT service management, cyber security)
• Maintain a network of cyber security peers across and beyond the NATO Enterprise to facilitate communications and coordination of urgent actions when the need arises.
• Research and identify, document and implement improvements to the Incident Response activities, in order to enhance and optimise current best practice to meet new and developing threats.
• Produce Standard Operating Procedure and Instructions covering all aspects of Incident Response.
• Participate in, and act as an Incident Response subject matter expert, in various meetings: within the CSIRT, across the sections in the Defend branch, across the NATO Enterprise, including within the NICC, CMAWG, CRMG and other Enterprise-level meetings, as well as within the context of a Cyber Incident Task force.

Requirements

Skills, Knowledge & Experience:

• The candidate must have a currently active NATO SECRET security clearance
• A minimum requirement of a Bachelor's degree at a nationally recognised/certified University in a related discipline and 3 years post-related experience;
• Or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience that is/are of interest to NCIA, that is, at least 10 years extensive and progressive expertise in duties related to those in this Statement of Work.
• At least 4 years practical experience in cyber security incident response, or a directly connected field such as network analysis, digital forensics, malware analysis or threat hunting. It is noted that Industry often separates responsibilities in such a way that personnel in these roles may also be performing incident response;
• Comprehensive understanding of the principles of Computer and Communication Security, networking, and the vulnerabilities of modern operating systems and applications acquired through a blend of academic or professional training coupled with practical professional experience;
• Recent practical, hands-on experience of Intrusion Detection and Incident Response (TRIAGE, Contain, Eradicate, Recover) in an enterprise-level Computer Emergency Response Team, ideally making use of the MITRE ATT&CK framework;
• At least 3 years experience in Information and Knowledge Management, ideally in the field of Cyber Security
• Experience in interfacing with IT Service Management.
• Very good communication and analytical skills.
• Language proficiency in English: meet or exceed the NATO STANAG 6001 Level 3 "Professional Proficiency".
• Knowledge of vulnerability assessment and scoring (CVSS, SSVC, CVD)
• Relevant certifications in cyber security, such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP) or GIAC Security.