RFQ - Security Accreditation Activities

McBride, based in McLean, VA, USA, and with offices in Brussels, BEL and Bucharest; ROU through its wholly owned subsidiary McBride International, is a Prime Contractor on the NCIA Advisory and Assistance Services Plus (AAS+) Framework.

We are a management and IT consulting firm with significant professional services experience that includes IT transformation, project management, digital transformation, strategic planning, business process improvement, change management, human capital management, systems engineering, and operations. Due to our excellent relationship with NATO and the first-class, security cleared candidates that we source and supply from all 32 NATO nations, we are extremely privileged to ask you to review this role to assess your suitability of skills.

You will be working as a contractor for our client the NATO Communications and Information Agency (NCIA)
NATO Communications and Information Agency (NCIA)
NCIA was established on 1 July 2012 from a merger of several NATO entities. It has a 65-year legacy of supporting NATO operations, missions, and exercises and is on the front lines against cyber threats, protecting NATO's networks 24/7. NCIA provides expertise and services that are critical to NATO's ability to fulfill its core tasks of consultation, collective defence, and crisis management.

In close coordination with the Site Security Officer (SSO) at each remote site, the CIS capability Service Delivery Manager (SDM) and the NCIA Security Accreditation Office, you will perform the following activities:

• Review existing security documentation and update it as required, to ensure compliance with security guidelines;
• Maintain a document library that contains the most updated site and system security documentation;
• Establish periodic communication with Site Security Officers to trigger and monitor their actions in updating site specific documentation within the agreed timelines;
• Create, and present to the customer, a periodic report that shows the security compliancy and pending actions of each site in terms of security related documentation;
• Keep existing user and administrator CIS Security Operating Procedures up-to-date;
• Create a basic training package, in PowerPoint format, that describes the actions each Site Security Officer shall perform to maintain local security documentation in compliance with security directives and guidelines;
• Review and provide constructive feedback on:
• Security Test and Verification Plans and Reports (STVP / STVR); and
• CIS Security description documents related to managed CIS systems.

Essential education, experience, and training:

• Comprehensive knowledge of the principles of computers and communication security, networking, and the vulnerabilities of modern operating systems and applications;
• At least five years of experience developing, maintaining, and updating CIS Security policies, standards, procedures and guidelines;
• Proven track record of mapping organizational security documentation to the CIS Security Controls and supporting compliance and audit readiness efforts;
• Hands-on experience conducting periodic reviews, gap analyses, and continuous improvement of security documentation to reflect evolving regulatory requirements;
• At least five years of experience collaborating with technical, operational and compliance stakeholders to ensure security procedures are accurate and aligned with the business risk management objectives;
• Demonstrable previous experience in maintaining version-controlled security documentation repositories and ensuring proper change management, approval workflow and traceability;
• At least three years of experience planning, conducting and documenting security testing and verification activities, such as control validation, CIS system configuration reviews and procedural walk-throughs, to confirm the effectiveness and operational readiness of CIS-security aligned security controls; and
• Very good knowledge of spoken and written English as work is conducted in English.

• Certified Information Systems Security Professional (CISSP);
• Certified Information Security Manager (CISM); and
• Certified in Risk and Information Systems Control (CRISC).

Personnel Security Clearance (PSC) NATO Secret