Requirement: Provision of RegOps Engineering to NCIA, SACT and CDT
Location: On-Site, NCIA, The Hague, NETHERLANDS
Cost Not to Exceed: 2026 BASE: 125,100 EUR
Period of Performance: 2026 BASE: As soon as possible but not later than 12 October 2026, through 31 December 2026
Required Security Clearance: NATO SECRET
Please do NOT apply for any NATO contract positions unless you meet ALL the following criteria:
- Current National or NATO SECRET clearance
- Nationality of one of the NATO member countries
- Current work visa for the specific location if applying for an in-country position
Statement of Work
Overall Project Scope
The NATO Communications and Information Agency (NCIA) located in The Hague, The Netherlands, is providing technical support to the NATO HQ Cyber and Digital Transformation (CDT) Division and Supreme Allied Command Transformation (SACT) by moving away from manual point-in-time audits, authorization to operate and security accreditation towards Continuous Governance, Risk and Compliance Auditing leading to Continuous Authorization to Operate (cATO) and Continuous Security Accreditation via EaC (Everything as Code) + Regulatory Operations (RegOps) using NIST OSCAL (Open Security Controls Assessment Language) data models, with the ultimate goal to deploy the RegScale platform as a workload and establish a Minimum Viable Product (MVP) for Continuous Authorization to Operate (cATO).
Specific Expertise Required
The services described in this SOW require contractor personnel with experience in Enterprise Architecture and in addressing challenges related to interoperability.
Required:
- The candidate must have a minimum of a Bachelor's degree from a nationally recognized/certified University in a related discipline and 3 years of related post-degree experience.
- The candidate must have a minimum of 3 years' experience with Kubernetes, API Integration (REST), Python /Scripting, and CI/CD pipelines.
- The candidate must have a minimum of 3 years' experience drafting technical data flows.
- The candidate must have a minimum of 3 years' experience with Webhooks and Jira/ServiceNow APIs.
- The candidate must have a minimum of 3 years' experience with M365 Graph API and Security Center.
- The candidate must have a minimum of 3 years' experience with red-teaming compliance.
- The candidate must have a minimum of 3 years' experience with PowerShell, Cloud APIs, and JSON.
- The candidate must have a minimum of 3 years' experience with OAuth2, OIDC, and Identity Management.
- The candidate must have documented (or demonstrable) experience in process analysis and design techniques.
