BACKGROUND INFORMATION
As part of multi-country National Computer Incident Response Team (CIRT) implementation projects coordinated by the ITU, the Senior CIRT Technical and Operations Consultant will provide on-demand expertise to strengthen national cybersecurity incident response capabilities across various countries. He/she will be responsible for deploying and integrating core cybersecurity tools, improving incident management mechanisms, and delivering technical training to ensure the operational readiness and long-term sustainability of national CIRT capabilities.
TERMS OF REFERENCE
Under the guidance of the ITU Project Manager and in close collaboration with the ITU Senior Cybersecurity Coordinator, the Consultant will perform the following activities for each assigned country project:
- Assess Current Infrastructure: Conduct an in-depth technical assessment of the national CIRT infrastructure, including network architecture, systems, security controls, logging, monitoring, and data flows.
- Technical Architecture Design: Define and document the CIRT technical architecture, including system components, network segmentation, data flows, integrations, and detailed technical specifications for platforms and tools, ensuring scalable, resilient, and interoperable operations aligned with CIRT/SOC operational workflows.
- Platform Deployment: Install, configure, customize, integrate, and test core CIRT technical platforms (e.g., RTIR, MISP, OpenCTI, Elastic, Wazuh, Security Onion, Graylog, T-POT, TARANIS, Ghidra), including scripting and automation to enable interoperability, data exchange, and efficient operational workflows.
- Web Portal and Communications: Deploy and configure the CIRT’s web portal and communication tools to facilitate information sharing and stakeholder engagement.
- Testing and Training: Perform functional, integration, and performance testing of deployed CIRT/SOC tools; validate data flows, interoperability, and automation pipelines; and deliver hands-on technical training to develop CIRT staff proficiency in system administration, tool configuration, incident workflows, and day-to-day operational management of the deployed solutions.
- Support and Handover: Provide remote technical support throughout the assignment and prepare comprehensive handover documentation (including technical manuals and Standard Operating Procedures) to enable local teams to sustainably operate the CIRT systems post-engagement.
CONCRETE DELIVERABLES
- Infrastructure Assessment Report: Submission of a detailed report on the CIRT infrastructure and network, with recommendations for improvements.
- Technical Implementation Plan: Delivery of a comprehensive implementation plan and architecture design for the national CIRT technical environment.
- Deployed CIRT Platforms: Fully installed, configured, customized and tested CIRT platforms and tools ready for operational use.
- User Guides and SOPs: Submission of Standard Operating Procedures (SOPs) and user manuals for the deployed tools and processes.
- Training Sessions Delivered: Completion of technical training workshops for CIRT staff, building their capacity to use and maintain the new systems.
COMPETENCIES
- Effective technical and analytical problem-solving skills including a demonstrated ability to understand and analyse project priorities.
- Effective communication and writing skills with strong drafting and documentation skills to produce high-quality policy and procedural documents.
- Ability to work independently and as part of a team, maintaining efficient working relationships, while demonstrating sensitivity to ITU's multi-cultural, multi-ethnic environment and respect for diversity.
QUALIFICATIONS REQUIRED
Education:
Advanced university degree in computer science, engineering (telecommunications, systems, cybersecurity), or a related field OR education from a reputed college of advanced education, with a diploma of equivalent standard to that of an advanced university degree in one of the fields above.Recognized professional certifications such as CISSP, CISM, CISA, ISO/IEC 27001 Lead Implementer or equivalent would be an asset.
Experience:
At least seven (7) years of professional experience in cybersecurity operations or incident response, including at least three (3) at the international level.Experience in conducting, monitoring and assessing projects for effective implementation.
Hands-on experience of incident response, digital forensics, cybersecurity analysis tools, operating systems (particularly Linux/Unix), CIRT/SOC open-source tools (e.g. familiarity with the RTIR, MISP, OpenCTI, Elastic, Wazuh, Security Onion, Graylog, T-POT, TARANIS, Ghidra), and virtualized hosting environments are highly desirable.
Proven experience in the deployment, customization, integration, and automation of CIRT/SOC technical solutions, including scripting for operational workflows and system interoperability, is highly desirable.
A Doctorate in a related field can be considered as a substitute for three years of working experience.
Languages:
Knowledge of English at advanced level. Knowledge of another official language of the Union (Arabic, Chinese, French, Russian, Spanish) would be an advantage.
REMUNERATION INFORMATION
Between USD 280 and USD 450 per working day to be defined according to the work experience of the consultant.