Security Engineer

• Providing Web, infrastructure and application level penetration testing, including but not limited to COTS software and NOTS/GOTS software (NATO/Government off the Shelf), following clearly defined methodologies.
• Participating in kick-off meetings with stakeholders and technical points of contact in order to identify requirements for testing.
• Following the documented procedures and workflows outlined by the technical leads.
• Attending team meetings if required.
• Writing technical reports in fluent English, following defined templates and Reporting Tools.
• Briefing, at both executive and technical levels, on security reports and testing outcome, including at flag officer level.
• In case of new vulnerabilities detected for COTS software, following the Responsible Disclosure Process and following-up with vendors and stakeholders.
• Providing security design reviews to ensure compliance with NATO policies and directives.
• In co-ordination with the Technical Lead of the Penetration testing team, ensuring proactive collaboration and coordination with internal and external stakeholders.
• Staying abreast of technological developments relevant to the area of work.
• Performing any other duties as may be required.
• The measurement of execution for this work is sprints, with each sprint planned for a duration of 5 days.

Penetration Testing Service

Site Reliability Engineer

• Supporting NATO with IT services through leveraging public cloud (Microsoft Azure)
• Ensuring secure, available, managed and compliant delivery of Public Cloud Services to NATO
• Operation of cloud infrastructure in Microsoft Azure using DevSecOps practices
• Deploying and managing landing zones;
• Building, deploying and maintaining containerized workloads using Azure Kubernetes Services (AKS)
• Monitoring the performance and effectiveness of landing zones and cloud workloads
• Collaborating with IT security, compliance, and other teams
• Conducting audits and ensuring compliance with governance controls such as Azure policies

Support for DevSecOps Engineering

Accounting Manager

• Under the direction of the Senior Administrator (AP/AR) the incumbent will perform duties such as the following:
• - Assist in developing policy, procedures, and document processes with and on behalf of the Senior Administrator, for higher level management review as required. Draft correspondence;
• - Identify and implement opportunities for process improvement;
• - Maintain the NCI Agency Customer Data Management;
• - Implement and execute the Accounts Receivable process, and handling customer invoices and credit notes. Resolving day-to-day operational issues;
• - Process all receivables transactions in accordance with NATO Financial Regulations (NFRs), Financial Rules and Procedures (FRPs), Agency Directives and guidance, and contractual conditions;
• - Maintain proper accounting records, such as correct entries in the AR sub-ledger, and supporting files for accounts receivable transactions;
• - Process, validate and complete accounts receivable transactions, ensuring they are recorded on the proper customer accounts, revenue and receivables general ledger accounts, and project dimension;
• - Monitor the open AR transactions balances and their aging balance to ensure that these are collected within their related customer payment terms, liaise for credit collection with Treasury section.
• - Reconcile the AR sub-ledger with the General Ledger, and the underlying feeder systems (e.g. project billing module);
• - Prepare reports on the processing of AR invoices and customer aging;
• - Liaise with other parts of the Agency and/or Customers to resolve any problems with the processing of AR invoices, and provide them with regular customer account statements;
• - Assist in preparing the Agency's Annual Financial Statements and responding to IBAN (External Auditor) enquiries;
• - Work independently without supervision;
• - Deputize for higher grade staff, if required;
• - Performs other duties as may be required.

Senior Assistant, Accounting Services

QA Engineer

• **1 INTRODUCTION**
• The NATO Information and Communication Agency (NCIA) located in The Hague, The Netherlands, is involved in the maintenance and development of command and control capabilities for NATO as well as in the support of these capabilities.
• In the light of these activities, the C2 Business Area is looking for an Application Test Engineer with experience in MS Windows and web applications testing.
• **2 OBJECTIVES**
• The main objective of this statement of work is to provide application-testing expertise and ensure the quality of the various applications within the domains of Force Management and Operations Planning, CBRN and Land C2 application services.
• Delivery of the services under this statement of work requires skills and experience as application test engineer for MS Windows and web applications
• **3 SCOPE OF WORK**
• The contractor will be work under the direction and guidance of a NCIA technical lead and product manager, and will provide the service using an agile and iterative approach using multiple sprints. Each sprint is planned for an approximate duration of 2 weeks.
• The work shall be executed mainly on-site at the NCIA The Hague. In exceptional cases, sprints might require the visit to other NATO sites and for such visits, the travel cost will be reimbursed separately. The work will be carried out accessing the Azure DevOps NATO Software Factory development environment as well as other Agency testbeds.
• __The key responsibilities of an Application Test Engineer to be performed are: __
• - Test Planning and Design: Creating detailed test plans, test cases, and test scripts to cover various aspects of the application, including functionality, performance, security, and usability.
• - Test Execution: Running tests, both manually and through automation, to identify bugs and ensure the application meets requirements.
• - Defect Management: Logging and tracking defects using bug-tracking tools, and working with developers to resolve them.
• - Test Automation: Developing and implementing automated test scripts to improve testing efficiency and coverage.
• - Collaboration: Working closely with developers, business analysts, and project managers to ensure a smooth and efficient testing process.
• - Test Environment Management: Setting up and maintaining test environments to ensure accurate and reliable testing.
• - Reporting: Generating reports on test results, defect status, and overall application quality.
• - Continuous Improvement: Identifying areas for improvement in the testing process and implementing solutions to enhance efficiency and effectiveness.

Application Test Engineer, MS Windows, Web

Deadline Date: Monday 15 September 2025
Requirement: Provision of Technical Software Tester Services Support the NIRIS Testing
Location: Off-Site
Note: Please refer to your Subcontract Agreement, article 6.4.1.a, which states “Off-Site Discount: 5% (this discount is applicable to all requirements, and applies when the assigned personnel are permitted to work Off-Site, such as at- home)". Please be sure to price this discount in your overall price proposal when submitting bids against off-site RFQs
Period of Performance: 2025 BASE: starting date 13th of October 2025 – 31st December 2025 with possibility to exercise the following options:
2026 Option: 1st January 2026 until 31st December 2026
2027 Option: 1st January 2027 until 31st December 2027
2028 Option: 1st January 2028 until 31st December 2028
Required Security Clearance: NATO SECRET
1 INTRODUCTION: The NATO Communications and Information Agency (NCI Agency) located in The Hague, The Netherlands, is currently involved in the development of new capabilities for NATO as well as in the support of existing capabilities. In the light of these activities, the C2 Service Centre is looking for ONE technical software tester.
2 OBJECTIVES: Test, update and maintain NIRIS software modules.
3 SCOPE OF WORK: Under the direction / guidance of the Solution Architect, Service Delivery Manager, Test Manager and Project Manager, the services to be provided are related with executing and maintaining the NIRIS test cases. This includes the following activities: Write, execute and maintain the NIRIS test cases both manually and automatic. Work closely with the developers/subject matter experts to understand the product use cases and features. Attend to team meetings to provide progress updates, and impediments to the colleagues and delegated staff. Share the knowledge inside the team, organize trainings or demos and document the information knowledge database. Work independently, self-organized with focus on outcome that match the teams’ target. Create setups that include Virtual Machines and standard servers (DNS, HTTP, Active Directory, and Monitoring) on Linux based operation systems. It is envisioned that these services are provided by ONE CONTRACTOR experienced software tester.
4 ROLES AND RESPONSIBILITIES: The development and testing services will be carried out on an Agency-provided laptop while using remotely the engineering and test facilities in the NATO Software Factory hosted in Microsoft Azure. These facilities consists of all necessary development and test services (such as Gitlab, Jira, Zephyr, Nexus…). The contractor shall update the status of the NIRIS development tasks in Jira, commit code in Gitla b, and maintain test procedures and test results in Zephyr. Some of the work could also be requested to be conducted locally in NCI Agency in The Hague, The Netherlands. The contractor will be part of a team (Service Delivery Manager, Project Manager, Solution Architect, Technical Lead, Software Developers, Testers, etc.) geographically distributed and working using an Agile and iterative approach using multiple sprints. Each sprint is planned for a duration of one (1) week.
5 DELIVERABLES AND PAYMENT MILESTONES: Detailed resource assessments will be agreed during each sprint meeting as set out in Section 6. Payments shall be dependent upon the successful acceptance of each sprint and the validation as set out under Section 6. All Invoices shall be accompanied with a Certificate of Acceptance (COA, Annex B) signed by the Contractor and project authority. Each sprint has a duration of one week. The content, scope and acceptance criteria of each sprint will be agreed during the sprint‐planning meetings as covered in Section 6, in writing. Each payment milestone cycle is planned for a duration of one calendar month. Upon completion and validation of each sprint and at the end of the monthly milestone, all completed sprints can be submitted for payment. The NCIA team reserves the possibility to exercise a number of sprints later, based on the same sprint deliverable timeframe and cost, depending on project priorities and requirements. In 2025, the following deliverables are expected from the service as set in this statement of work. Deliverable: Up to 12 sprints for NIRIS software testing (Number of sprints is estimated and will be adjusted based on actual starting date.) Payment Milestones: Payment Milestones will be end of the month for all the Sprints completed and accepted within the respective month 2026 Option: 01 January to 31 December 2026 Deliverable: Up to 41 sprints Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5. Payment Milestones: Payment Milestones will be end of the month for all the Sprints completed and accepted within the respective month 2027 Option: 01 January to 31 December 2027 Deliverable: Up to 41 sprints Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5. Payment Milestones: Payment Milestones will be end of the month for all the Sprints completed and accepted within the respective month 2028 Option: 01 January to 31 December 2028 Deliverable: Up to 41 sprints Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5. Payment Milestones: Payment Milestones will be end of the month for all the Sprints completed and accepted within the respective month
6 COORDINATION AND REPORTING: Due to the AGILE approach of this project, there is a need to define a set of specific arrangements between the NCI Agency and the resource that specifically defines the deliverables to be provided for each sprint as well as their associated acceptance criteria. This includes sprint planning, execution and review processes, which are detailed below: Sprint Planning: Objective: Plan the objectives for the upcoming sprint. Kick-off meeting: Conduct an initial meeting with the contractor to plan the objectives of upcoming sprints. Set sprint goals: Define clear, achievable goals for the sprint. Backlog Review: Review and prioritize the backlog of tasks, issues, and improvements from previous sprints. Sprint Execution: Objective: The resource to execute the “sprint plans” with continuous monitoring and adjustments. Regular meetings (including daily stand-up) between NCI Agency and the contractor to review sprint progress, address issues, and make necessary adjustments to the processes or production methodology. The meetings will be physically in the office, or in person via electronic means using Conference Call capabilities, according to the NCI Agency project manager’s instructions. Continuous improvement: The resource to establish a continuous feedback loop to gather input from all stakeholders for ongoing improvements and their subsequent implementation depending on NCIA approval. Progress Tracking: The resource to use a shared dashboard or tool to track the status of the sprint deliveries and any issues. Sprint Review: Objective: Review the sprint performance and identify areas for improvement. At the end of each sprint, there may be a meeting between the NCI Agency and the team to review the outcomes. Define specific actions to address issues and enhance the next sprint. Sprint Payment: For each sprint to be considered as complete and payable, the resource must report the outcome of their work during the sprint within three days after the sprint’s end date. A report must be sent by email to the NCI Agency project manager, listing all the work achieved against the agreed tasking list set for the sprint. The payment shall be dependent upon successful acceptance as set in the above planning/review meetings. This will follow the payment milestones that shall include a completed Certificate of Acceptance (COA) – See Annex B. Invoices shall be accompanied with a Certificate of Acceptance sheet (COA) – (Annex B) signed by the Contractor and project authority. 7 SCHEDULE: This task order will be active immediately after signing of the contract by both parties. It is expected that the initial services start being provided in October 2025 (13th October 2025 – tentative start date) and ending not later than December 2025. If the sprints of the annual options are exercised, the period of performance is within 01 January to 31st December of the relevant year. 8 SECURITY: Performance of the services described in this SOW require a valid NATO SECRET security clearance provided by the national security organization and valid at the time of submission of the bid covering the period of the requirement. 9 CONSTRAINTS: All the documentation provided under this statement of work will be based on NCI Agency templates or agreed with project point of contact. All scripts, documentation and required code will be stored under configuration management and/or in the provided NCI Agency tools. 10 PRACTICAL ARRANGEMENTS: The contractor is expected to work off site. Work on-site can also be arranged with the Project Manager. It may be required to travel to NCI Agency The Hague and other sites within NATO for completing these tasks. Travel costs are out of scope and will be borne by the NCI Agency separately in accordance to the provisions of the AAS+ Framework Contract. This work must be accomplished by ONE resource. In the event the contractor leaves during the contract period, he or she shall be replaced by a new contractor who has the required qualifications and is acceptable. AAS Framework contract Terms and Conditions apply. 11 QUALIFICATIONS: [See Requirements]

EMW

Penetration Testing Service

Support for DevSecOps Engineering

Senior Assistant, Accounting Services

Application Test Engineer, MS Windows, Web

Technical Software Tester, NIRIS Testing