#NC25CSG180818 - Support for Web Application Security Assessment (WASA) - Closed
Deadline: July 10, 2025
Requester: NATO
Location: Mons, Belgium
Start date: August, 2025
Security clearance: NATO SECRET
SCOPE OF WORK / DUTIES / ROLES
-
Black box testing: Results are published on the dedicated portal when they are found – contractor must monitor the portal at least once a day. In reality an email notification mechanism is available.
- Once the new vulnerability is found, appropriate technical POC’s must be contacted. Depending on the severity it must be done immediately or on the weekly basis.
-
Grey box testing are performed according to the planned schedule. Once the assessment is finished there is an assessment report released.
- Contractor must review and validate the discovered vulnerabilities and their severity;
- On every assessment report must prepare remediation plan and provide it the appropriate technical POC.
-
Progress on the remediation plans for all sites Must be verified at least once a week. Work might need to be performed in parallel for different sites. Remediation plan and dashboards need to be updated as soon as we have
updates from the involved parties; -
Communication is often used on Internal NATO Systems, therefore the Contractor must work onsite (Mons Office) to be able to check;
-
Keep and maintain WASA inventory sheet with all stakeholders’ information for all sites;
-
Once a week contractor takes part in the progress meeting with the stakeholders (OCIO). Contactor maintains the dashboards and spreadsheets reflecting the current status of the remediation activities for all the active assessment campaigns;
-
Once a month contactor is preparing the presentation and briefs at the Enterprise Vulnerability Assessment Plan (EVAP). It is a program under OCIO supervision;
-
Track and trace other vulnerabilities provided from different sources if those vulnerabilities are related to the scope of the Web Application Security Assessment (WASA) campaign;
-
Meetings with stakeholders in Brussels (this type of activity may occur max 1 per month).
REQUIRED SKILLS, KNOWLEDGE AND EXPERIENCE
-
5 years of experience in web applications assessment, with proven experience within the last 6 months;
-
General knowledge of cyber security principles, best practices, concepts and technology;
-
Knowledge of cyber security architectures, including boundary protection, encryption, identity and access management, monitoring and detection, incidence response, vulnerability assessments, and risk management;
-
+ 3 years of experience in testing and validating that contracted deliveries meet the security requirements and fulfil the intended use-cases;
-
Familiarity with NATO security policy and supporting directives is desirable;
-
Knowledge of Web Application Security Assessment (WASA) environment;
-
Ability to work independently and in teams to achieve the desired goals;
-
The ability to take ownership of tasks and strong motivation to accomplish them to the end;
-
Excellent communications and writing skills in English.
This position is now closed.
We regularly add new positions. We suggest exploring other available opportunities and staying updated by following our LinkedIn page.
If you don’t find any suitable opportunities, you can send us your CV, as an open application. However, we will not submit you to any vacancies without your written consent.