Jobid=635290145340131986 (0.05)
A control catalogue written in prose cannot be checked by a machine. Your job would be to change that.
A multinational defence organisation in The Hague, Netherlands is digitising its security control baseline so that compliance can be measured continuously rather than audited once a year. You would architect the translation — from written standards to structured, machine-readable control data.
What you would be doing
- Reviewing the existing security requirement statements and the NIST or ISO baseline behind them, ready for conversion
- Importing that baseline into a structured, machine-readable control format
- Identifying and documenting the technical triggers that the cloud environment can raise
- Mapping those triggers to specific control identifiers — policy as code
- Reviewing sampled automated evidence for completeness, accuracy and fitness to support a system security plan
- Generating the first full system security plan from automated evidence rather than by hand
- Running stakeholder sessions to validate the assumptions, mappings, evidence sources and the generation logic
- Tracking issues through to remediation
What you would bring
- A bachelor's degree in a related discipline with three years of related experience
- Three years across all of: NIST and ISO control frameworks; confident JSON and YAML; and regulatory mapping
- Translating compliance requirements into code
- Documented experience of process analysis and design
Nice to have
- Real technical knowledge of how allied organisations achieve interoperability
- A working understanding of defence cloud strategy
- ITIL, COBIT or an equivalent
Why this one is worth a look
Very few architects have taken a real control catalogue all the way into code and out again as a generated security plan. This is that piece of work, on a serious estate.
Deel deze vacature: