Job Description

A NATO communications and information systems unit at Ramstein needs someone to own
cyber security for the site. Not a monitoring seat: you would be the section head, with three or
four cyber security and COMSEC people reporting to you, responsible for every part of the security
picture from the boundary in.

What you would be doing

• Leading a team of three to four cyber security and COMSEC staff through day to day
  operations.
• Owning the administration of all cyber security activity for the site, coordinated with the
  central NATO cyber security organisation - boundary protection management, data loss prevention and
  enterprise antimalware among them.
• Applying and maintaining the specific security controls that policy and local risk assessments
  call for.
• Running risk assessments for smaller information systems, identifying the risks that come with
  a proposed technical architecture, and suggesting the countermeasures that reduce them.
• Defining secure system configurations that match the intended architecture.
• Supporting the investigation of suspected attacks and security breaches.
• Scheduling, coordinating and facilitating security audits and inspections, then managing the
  post inspection actions.
• Supervising the monitoring, testing and evaluation of computer security systems, and the
  security side of CIS accreditation.
• Planning and where necessary implementing cyber security services for the other parts of the
  organisation.
• Explaining security risk to business managers in language they can act on.

What they are looking for

• Five years or more of Windows Server security hardening - security baselines,
  policy enforcement, vulnerability mitigation and system compliance.
• Three years or more with Trellix ePolicy Orchestrator and Trellix Endpoint Security,
  including Data Loss Prevention and Application Control, or an equivalent security suite.
• Two years of system security, security architecture, network security engineering, security
  governance and risk management.
• Detailed working knowledge of security and networking technology: IPv4, software firewalls,
  VPNs, intrusion detection and forensic tools.
• Practical experience of wireless LAN technology and endpoint security across laptops, tablets
  and phones.
• Security incident handling, reading the results of a security audit, and conducting risk
  assessments.
• Supporting large NATO enterprise CIS estates, with a working understanding of the NATO command
  structure and of NATO security policy and its supporting directives.
• CISM or CISSP certification. Also valued: CGRC/CAP or CASP+ (or Cloud+,
  PenTest+, Security+, GSEC or equivalent), ITIL v3 or v4 Foundation, and the NATO COMPUSEC
  Practitioner and CIS Security Officer courses.
• Palo Alto enterprise firewalls, Public Key Infrastructure, and centralised endpoint security -
  antivirus, DLP, application control, drive encryption - plus vulnerability scanning with
  Nessus.
• Windows Server 2022, 2019 and 2016, and Windows 10 and 11.
• Server, network and storage virtualisation: VMware vSphere, ESX, NSX and vSAN. A grounding in
  cloud technology.
• Familiarity with ITIL or another service management framework - incident, request fulfilment,
  problem, change and capacity management - and the basics of disaster recovery and business
  continuity (RPO, RTO, MTTR, MTBF, active-active and active-passive).
• A bachelor's degree in a related discipline with two years of relevant experience. Exceptionally,
  six years or more of progressive experience in the same work can stand in place of the degree.
• English to NATO STANAG 6001 level 3 (3333), or B2 to C1.
• Previous work in an international environment with both military and civilian elements.

Practical detail

• Fully on site in Ramstein, Germany.
• 38 hours a week, Monday to Friday, with an unpaid lunch break per local practice.
• 1 October to 30 December 2026, 420 hours in total.
• You must hold a valid clearance and be a citizen of a NATO member country.

If you have run a security section rather than sat in one, and you can hold your nerve in an
inspection week, this is the shape of role that suits you.