Cyber Security Section Head (Trellix ePO, Windows Hardening, CISSP) for NATO with security clearance

A NATO communications and information systems unit at Ramstein needs someone to own cyber security for the site. Not a monitoring seat: you would be the section head, with three or four cyber security and COMSEC people reporting to you, responsible for every part of the security picture from the boundary in.

What you would be doing

• Leading a team of three to four cyber security and COMSEC staff through day to day operations.
• Owning the administration of all cyber security activity for the site, coordinated with the central NATO cyber security organisation - boundary protection management, data loss prevention and enterprise antimalware among them.
• Applying and maintaining the specific security controls that policy and local risk assessments call for.
• Running risk assessments for smaller information systems, identifying the risks that come with a proposed technical architecture, and suggesting the countermeasures that reduce them.
• Defining secure system configurations that match the intended architecture.
• Supporting the investigation of suspected attacks and security breaches.
• Scheduling, coordinating and facilitating security audits and inspections, then managing the post inspection actions.
• Supervising the monitoring, testing and evaluation of computer security systems, and the security side of CIS accreditation.
• Planning and where necessary implementing cyber security services for the other parts of the organisation.
• Explaining security risk to business managers in language they can act on.

What they are looking for

• Five years or more of Windows Server security hardening - security baselines, policy enforcement, vulnerability mitigation and system compliance.
• Three years or more with Trellix ePolicy Orchestrator and Trellix Endpoint Security, including Data Loss Prevention and Application Control, or an equivalent security suite.
• Two years of system security, security architecture, network security engineering, security governance and risk management.
• Detailed working knowledge of security and networking technology: IPv4, software firewalls, VPNs, intrusion detection and forensic tools.
• Practical experience of wireless LAN technology and endpoint security across laptops, tablets and phones.
• Security incident handling, reading the results of a security audit, and conducting risk assessments.
• Supporting large NATO enterprise CIS estates, with a working understanding of the NATO command structure and of NATO security policy and its supporting directives.
• CISM or CISSP certification. Also valued: CGRC/CAP or CASP+ (or Cloud+, PenTest+, Security+, GSEC or equivalent), ITIL v3 or v4 Foundation, and the NATO COMPUSEC Practitioner and CIS Security Officer courses.
• Palo Alto enterprise firewalls, Public Key Infrastructure, and centralised endpoint security - antivirus, DLP, application control, drive encryption - plus vulnerability scanning with Nessus.
• Windows Server 2022, 2019 and 2016, and Windows 10 and 11.
• Server, network and storage virtualisation: VMware vSphere, ESX, NSX and vSAN. A grounding in cloud technology.
• Familiarity with ITIL or another service management framework - incident, request fulfilment, problem, change and capacity management - and the basics of disaster recovery and business continuity (RPO, RTO, MTTR, MTBF, active-active and active-passive).
• A bachelor's degree in a related discipline with two years of relevant experience. Exceptionally, six years or more of progressive experience in the same work can stand in place of the degree.
• English to NATO STANAG 6001 level 3 (3333), or B2 to C1.
• Previous work in an international environment with both military and civilian elements.

Practical detail

• Fully on site in Ramstein, Germany.
• 38 hours a week, Monday to Friday, with an unpaid lunch break per local practice.
• 1 October to 30 December 2026, 420 hours in total.
• You must hold a valid clearance and be a citizen of a NATO member country.

If you have run a security section rather than sat in one, and you can hold your nerve in an inspection week, this is the shape of role that suits you.