Digital Trust Advisor (Risk, Controls and Executive Reporting) for NATO with security clearance

ph3Automated evidence is worthless until an auditor accepts it. This post is about making that case, properly. /h3pA multinational defence organisation in The Hague, Netherlands is piloting continuous assurance over its cloud estate. You would lead the governance side of that pilot: define it, test whether the evidence really holds, and show the leadership what it means. /ph3What you would be doing /h3ulliRunning the stakeholder discussion that fixes the pilot's scope, target environment, priority application, success criteria and risk areas /liliAgreeing roles, responsibilities, dependencies and decision points with the cloud, compliance, audit and business sides /liliJudging whether automated evidence from cloud and software services is complete, reliable, traceable and fit for purpose /liliMapping that digital evidence to the controls, audit requirements and assurance expectations it is supposed to satisfy /liliReviewing the dashboard so that it reflects live risk, control status and compliance rather than a comfortable picture /liliPreparing the demonstration that explains the dashboard, the insights and the business value to an executive audience /liliRunning review sessions to validate assumptions and mappings, and tracking issues to remediation /li /ulh3What you would bring /h3ulliA bachelor's degree in a related discipline with three years of related experience /liliThree years across all of: leadership; communication; strategy; risk management; audit standards; and building a return-on-investment case people can follow /liliDocumented experience of process analysis and design /li /ulh3Nice to have /h3ulliReal technical knowledge of how allied organisations achieve interoperability /liliA working understanding of defence cloud strategy /liliITIL, COBIT or an equivalent /li /ulh3Why this one is worth a look /h3pIt is the rare governance post with a technical spine: you would be judging real automated evidence, not writing policy about it. /p /p #J-18808-Ljbffr