Staff Officer; Cyber Security​/Incident Response Manager

ACT contributes to preserving the peace, security and territorial integrity of Alliance member states by leading, at Strategic Command level, Warfare Development required to enhance NATO's posture, military structures, forces, capabilities and doctrines. The Resources and Management (RM) Directorate acts on behalf of SACT on all internal management and resource-related issues. It monitors the coherency of ACT plans to ensure that ACT remains an effective and efficient organization and improves continuously.

The ACT CIS, Data & Information (ACT CDI) Branch brings Information and Communications Technology (ICT) coherence across HQ SACT. It is in charge to implement at HQ SACT level all NATO policies and Directives in is area of responsibility. The ACT CDI is co-responsible with AOS (ACT Office of Security) of the HQ Cybersecurity, Cyber awareness and Cyber Hygiene. It is also critical enabler within the command and control of all HQ SACT staff tasking.

This essential enabling support function provides coherency to the Command's IKM requirements delivers enhanced decision-making process opportunities and provides a central management function that guarantees the through-life cycle of all information and knowledge management within ACT.

• Contribute to the implementation of the CISOA's role and responsibilities within HQ SACT and the subordinate commands (JWC, JFTC, JALLC, JATEC);
• Perform real-time cyber defense incident handling tasks (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation)
  Conduct security triage to identify and analyze cyber incidents and threats;
• Actively monitor networks and systems for cyber incidents and threats;
• Conduct risk analysis and security reviews of system logs to identify possible cyber threats;
• Conduct analysis and review, and/or apply network scanners, vulnerability assessment tools, network protocols, internet security protocols, intrusion detection systems, firewalls, content checkers and endpoint software;
• Collect and analyze data to identify cyber security flaws and vulnerabilities and make recommendations that enable prompt remediation;
• Develop and prepare cyber defence incident analysis and reporting;
• Define and maintain tool sets and procedures;
• Develop, implement, and evaluate prevention and incident response plans and activities, and adapt to contain, mitigate or eradicate effects of cyber security incident;
• Provide incident analysis support on response plans and activities;
• Conduct research and development on cyber security incidents and mitigations;
• Create a program development plan that includes security gap assessments, policies, procedures, playbooks, and training manuals;
• Review, develop and deliver relevant training material;
• Contribute to the execution of the Security Accreditation Process in collaboration with ACT Office of Security;
• Design, deploy and maintain the HQ SACT Cyber protection program which is to be complimentary to the capability output of HQ SACT. This must be considered a constantly changing environment, in particular enabling the communities of interest approach for staff work;
• Ensure information/knowledge resources are protected whilst remaining readily accessible and easily retrieved;
• Provide guidance on Cyber evolution across HQ SACT;
• Increase staff awareness and the best practises for Cyber hygiene;
• Contribute with NATO HQ and ACO to develop and maintain the NATO Cyber Security policies;
• Ensure the HQ SACT Cyber Defence Posture Level is maintained in coordination with OCIO and allows the functions of the HQ to continue;
• Develop and maintain external and internal relationships to enable the CDI Branch to achieve its aims;
• Contribute to the Cyber Incident…