Senior Penetration Tester

Mons, Belgium Deadline: 18-05-2026 Geplaatst: 05-05-2026 #16725

RFQ 2026-0057 - Penetration testing service - NPCL Support

Duties

  • Provide Web, infrastructure and application-level penetration testing, including but not limited to COTS software and NOTS/GOTS software (NATO/Government off the Shelf), following clearly defined methodologies.
  • Participate in kick-off meetings with stakeholders and technical points of contact in order to identify requirements for testing.
  • Follow the documented procedures and workflows outlined by the technical leads.
  • Attend team meetings if required.
  • Write technical reports in fluent English, following defined templates and Reporting Tools.
  • Brief at both executive and technical levels on security reports and testing outcome, including at flag officer level.
  • In case of new vulnerabilities detected for COTS software, follow the Responsible Disclosure Process and follow-up with vendors and stakeholders.
  • In co-ordination with the Technical Lead of the Penetration testing team, ensure proactive collaboration and coordination with internal and external stakeholders.
  • Stay abreast of technological developments relevant to the area of work.
  • Perform any other duties as may be required.
  • The contractor shall participate in daily status update meetings, activity planning and other meetings as instructed, physically in the office, or in person via digital means using conference call capabilities, according to the manager’s / team leader’s instructions.
  • For each sprint to be considered as complete and payable, the contractor must report the outcome of his/her work during the sprint, first verbally during the retrospective meeting and then in written within three (3) days after the sprint’s end date.
  • At the end of the project, the Contractor shall provide a Project Closure Report that is summarizing the activities during the period of performance at high level.
  • All activities should be: Logged and tracked in JIRA or agreed system, fully auditable, linked to scope and requirements.
  • The contractor is required to follow the rules and regulations applicable for the operations of NATO CIS.

Requirement

  • The service contractor will be required to have a Bachelor of Science (BSc) degree at a nationally recognised/certified university in a technical subject with substantial Information Technology (IT) content and 3 years post-related experience.
  • As an exception, the lack of a university degree may be compensated by the demonstration of a candidate’s particular abilities or experience that are of interest to the NCI Agency; namely, at least 10 years of extensive and progressive experience in the duties related to the functions of this post.
  • Extensive knowledge and experience (at least 3 years) in the following areas: Web application penetration testing
  • Extensive knowledge and experience (at least 3 years) in the following areas: IT infrastructure penetration testing
  • Extensive knowledge and experience (at least 3 years) in the following areas: Network security architecture design
  • Extensive knowledge and experience (at least 3 years) in the following areas: Assessing security vulnerabilities within OS, software, protocols & networks
  • Extensive knowledge and experience (at least 3 years) in the following areas: Researching and evaluating security products & technologies
  • Extensive knowledge and experience (at least 3 years) in the following areas: Knowledge in system and network administration of UNIX and Windows systems
  • Extensive knowledge and experience (at least 3 years) in the following areas: Use of penetration testing tools, techniques, and recognized testing methodologies
  • Extensive knowledge and experience (at least 3 years) in the following areas: Scripting skills in at least one of the following: Python, Go, PowerShell, shell (bash, ksh, csh)
  • Technical knowledge in system and network security, authentication and security protocols, cryptography, application security, as well as, malware infection techniques and protection technologies.
  • Ability to evaluate risks and formulate mitigation plans.
  • Proven ability to brief at executive level on security findings, reports and testing outcome.
  • Proven ability to write clear and structured technical reports including executive summary, technical findings and remediation plan for several different audiences.
  • It is mandatory to have the candidate be in possession of a NATO SECRET security clearance to facilitate follow-on engagements and coordination at NATO venues.
  • A thorough knowledge of one of the two NATO languages, both written and spoken, is essential and some knowledge of the other is desirable.

Preferences

  • Professional qualifications: OSCP, OSCE, OSWE, GPEN, CREST Certified Web Application Tester, GXPN, GWAPT or equivalent
  • Familiarity with risk analysis methodologies.
  • Prior experience of working in an international environment comprising both military and civilian elements.
  • Knowledge of NATO organization, internal structure and resultant relationships.
  • A thorough knowledge of one of the two NATO languages, both written and spoken, is essential and some knowledge of the other is desirable.

Reageren op aanvraag

Terug