Consultant - Ict Officer (Security Strategy and Governance)

Job Identification Number**:16678**
Position Title**:Consultant - ICT Officer (Security Strategy and Governance)**
Duty Station**:Valencia**
Duty Station Country**:Spain**
Contract Type**:Consultant, Six Months**
Recruiting Type**:Consultancy**
Vacancy Type**:Consultancy**
Initial Duration**:6 Months**
Closing Date**:28 October 2025**

**Project Context and Scope**:
**Organizational Department / Unit to which the Consultant is contributing**:
ICT Department - Information Security and Risk Management

**RESPONSIBILITIES
Category A Consultant: Tasks to be performed under this contract**
- Lead the development and execution of a comprehensive cybersecurity strategy that aligns with organizational goals and ensures robust risk and compliance management frameworks that address current and emerging threats.
- Establish and maintain a robust cybersecurity governance framework to ensure effective oversight, accountability, and decision-making across the organisation.
- Continuously assess and enhance IOM’s global security posture, including the evaluation of cybersecurity maturity across systems and processes.
- Develop and maintain cybersecurity roadmaps, including objectives, milestones and performance indicators for cybersecurity initiatives to guide the execution of strategic initiatives and track progress.
- Oversee vendor, contract, and change management activities related to cybersecurity, ensuring alignment with strategic objectives and compliance standards.
- Design and implement targeted communication campaigns and user awareness programs in collaboration with business management, fostering a culture of cybersecurity and risk consciousness.
- Collaborate with cross-functional teams to integrate cybersecurity into business processes and initiatives across all projects and programs.
- Deliver tailored training and technical advisory services to both ICT and non-ICT units, incorporating innovative approaches such as gamification and establishing a cybersecurity centre of excellence.
- Conduct comprehensive security assessments of on-premises and cloud environments, and manage third-party penetration testing engagements, including drafting terms of reference and performing quality assurance on deliverables.
- Identify, document, and report global cybersecurity risks, maintaining a centralized risk register and tracking mitigation efforts.
- Develop and maintain security policies and procedures based on international standards (e.g., ISO 27001, NIST, CIS), and produce essential documentation to support project and operational needs.
- Provide strategic guidance on the implementation of security controls to protect organizational assets and ensure resilience against emerging threats.
- Perform additional duties as assigned by the Senior Information Security Officer, contributing to cross-functional initiatives and organizational priorities

**Performance indicators for the evaluation of results**

**Governance Framework Delivery Rate**:
Percentage of planned cybersecurity governance documents dashboards, and frameworks developed, updated, or implemented within agreed timelines and quality standards (Target: 90% on-time completion with positive stakeholder feedback).

**Assessment Response Efficiency**:
Average turnaround time and completeness in responding to internal and external security assessments (Target: 100% of assessment requests addressed within established SLAs).

**Risk Mitigation Action Rate**:
Percentage of identified risk mitigation actions initiated or resolved during the reporting period (Target: 75% of risk mitigation actions tracked or closed).

**Exception and Waiver Processing Accuracy**:
Proportion of policy exceptions, waivers, and security control recommendations accurately documented, reviewed, and processed through proper approval workflows (Target: 100% compliance, zero overdue requests at month-end)

**QUALIFICATIONS
Education**
- Master’s degree in Computer Sciences, Information Systems Management, Engineering or Business Administration from an accredited academic institution with five years of relevant professional experience; or
- University degree in Computer Sciences, or relevant field from an accredited academic institution with seven years of relevant professional experience.
- Professional certification as CISSP, CISM, CCISO, CSSLP, CASE, CSWAE, GRCP, CEH, or related will be a distinct advantage in addition to cloud computing certifications at associate/professional/specialty level from Azure and/or AWS.
- ITIL and Prince2 Foundation are added advantages.

**Experience**
- Minimum of five years of experience in programme and project management of cybersecurity globally;
- Minimum of five years of experience in vulnerability testing and auditing and cloud security;
- Minimum of five years of experience with vulnerability scanning and configuration assessment solutions (e.g., Nessus, BurpSuite, CIS-CAT Pro, and Rapid7);
- Minimum of five years in all aspects of cybersecurity;
-