NATOIS-0046 Software Engineer (NS) BELGIUM - 15 Jul

Deadline Date: Wednesday 15 July 2026
 
Requirement: Software Engineer
 
Location: Brussels, BELGIUM
 
Full Time On-Site: No
 
Time On-Site: 50%
 
Not to Exceed Rate: 79 EUR
 
Option 1: Year 2027: Price will be determined by applying the price adjustment formula as outlined in CO-115786-AAS+ Special Provisions article 6.5.
 
Option 2: Year 2028: Price will be determined by applying the price adjustment formula as outlined in CO-115786-AAS+ Special Provisions article 6.5.
 
Total Scope of the request (hours): Base period of 2026: 38 hours/week, for a total of 18 weeks and a total of 684 hours.
 
Option 1: 30.4 hours/week, for a total of 42 weeks and a total of 1276.8 hours
Option 2: 30.4 hours/week, for a total of 42 weeks and a total of 1276.8 hours.
 
Period of Performance: 2026 BASE: 18 August - 31 December 2026, with possibility to exercise the following options:
 
Option 1: Jan - Dec 2027
Option 2: Jan - Dec 2028
 
Required Security Clearance: NATO SECRET
 
Please do NOT apply for any NATO contract positions unless you meet ALL the following criteria:

1. Current National or NATO SECRET clearance
2. Nationality of one of the NATO member countries
3. Current work visa for the specific location if applying for an in-country position

Any applications that do NOT meet all the above - and do not CLEARLY show these on the CV - will be deleted.
 
General
Introduction
 
The Cyber Threat Analysis Branch (CTAB) is looking for a Software Engineer with experience in application development and cloud-based infrastructure to support the development of NATO's cyber threat intelligence platform in order to enhance cyber threat intelligence production for the NATO Enterprise and Alliance.
 
Background Information

• The Joint Intelligence and Security Division (JISD), under the leadership of the Assistant Secretary General for Intelligence and Security (ASG I&S), comprises two principal pillars: Intelligence - headed by the Deputy ASG for Intelligence; and the NATO Office of Security (NOS) - headed by the Deputy ASG for Security. Intelligence is responsible for ensuring the situational awareness of the North Atlantic Council and the Military Committee, for the analysis of the indications and warnings in support of the NATO Crisis Response System and for the development of intelligence policies and capabilities for NATO. Its functional areas address: intelligence analysis and production, intelligence policy and capability development.
• The joint civilian and military Intelligence Production Unit (IPU), under the JISD, delivers strategic intelligence-based analysis to support North Atlantic Council (NAC) and Military Committee (MC) decision making on strategic issues of concern. The IPU produces a range of planned and tasked intelligence products on regional issues in Eurasia, Africa and the Middle East, and on transnational issues such as hybrid warfare, terrorism, instability, weapons of mass destruction and energy security.
• The Cyber Threat Analysis Branch (CTAB), under the IPU, is responsible for providing evidence-based assessments of the cyber threat landscape to empower NATO stakeholders to make risk-informed decisions. The multidisciplinary team combines all-source data with cutting edge technologies to support and enhance the Alliance leaderships' understanding on the nature of cyber competition and conflict. CTAB systematically identifies strategic patterns and trends in cyber space and generates tailored insights to support network defence and mission assurance with predictive analysis, cyber threat intelligence, and threat hunting.

Statements of Objectives
Corporate Objective
 
The contractor (Software Engineer) will support the work of the Cyber Threat Analysis Branch and be responsible for further developing the cloud-based NATO Cyber Threat Intelligence Platform.
 
Contract Objective

• Obtain specialist consulting services to support the following initiatives:
• Together with a senior Cloud Engineer, manage and improve NATO's cloud-based cyber threat intelligence platform by working on data pipelines, CI/CD workflows, code extensions, application updates and cloud architecture while keeping security and documentation front and centre.
• Together with Threat Researchers, design, develop and optimize API integrations and expand custom functionalities (in Python and Storm) within the platform to ensure correct ingestion and correlation of large amounts of technical and non-technical cyber threat intelligence data.
• Together with a Data Scientist, work to integrate artificial intelligence (such as Large Language Models) into the cyber threat intelligence platform by ensuring code quality and improving developed software.
• Continuously try to find new ways to improve the platform through developing and integrating novel extensions and applications that improve the ingestion, correlation and representation of data.

Management Objective
 
Allow the Contractor the maximum flexibility to innovatively manage its corporate resources and expertise so as to provide a high-value contribution in support to the NATO's corporate and contract objectives within existing constraints and available funding.
 
Requirements
Personnel and resources
General Requirements

• The contractor shall be proficient in English.
• The Contractor will require a NATO SECRET clearance.

Specific Requirements
In addition to the generic qualification requirements, the Contractor must have:

• A university degree from a nationally recognised/certified university in a technical subject with substantial software engineering and information technology content - OR - at least 2 years' experience similar to the tasks described in this SoW and relevant industry recognized certificates.
• Demonstratable knowledge of best practices for the software development life cycle, including coding standards, code reviews, and testing. Is familiar with CI/CD workflows, and can work with Terraform to implement them.
• Proficient in Python and a deep working knowledge of the Linux command line and git. Has demonstratable knowledge in managing and orchestrating Docker containers and working with Kubernetes. Demonstrated ability and willingness to learn new programming languages and technologies quickly, with a focus on applying them effectively in production environments. Knowledge of the Storm Query Language (from Synapse Vertex) is strongly preferred but not required for this role.
• Expertise in AWS and cloud best-practices, with working knowledge of modern AWS services such as Lambda, API Gateway, CloudFront, Route 53, and ALB/NLB. Similar knowledge of Azure is preferred but not required for this role. Strong experience working with RESTful APIs, including data ingestion, transformation, and integration.
• Previous experience with full-stack applications including modern frontend development is strongly preferred but not required for this role.
• Experience within cybersecurity and/or the intelligence domain is strongly preferred but not required for this role.
• Good communication skills, both orally and written. Able to translate complex technical topics into information conveyable to non-domain experts. Can easily cooperate with non-engineers and explain conducted work, as well as give and take feedback.