Cybersecurity Enabling Environment Lead

Component 1 Cybersecurity Enabling Environment Lead for U.S. Cybersecurity for Critical Infrastructure in Ukraine (CCI) Activity

BACKGROUND:

The U.S. Cybersecurity for Critical Infrastructure in Ukraine (CCI) Activity began in May 2020. The purpose of the CCI Activity is to reduce, and ultimately eliminate, cybersecurity vulnerabilities in Ukraine’s critical infrastructure sectors. In the same way that cyberattacks drove Estonia to innovate cybersecurity practices, systems, and entrepreneurship as the backbone of its digital transformation.

The CCI Activity continues to improve the cyber-resilience of Ukraine and its critical infrastructure sectors through three interlinked, mutually reinforcing objective areas that address legal, policy, institutional, workforce, and market gaps to strengthen long-term national resilience.

Building on progress achieved from 2020 to 2026, and under the Department of State, the Activity will continue implementation of these objectives while aligning them with U.S. foreign-policy priorities for trusted technology, supply-chain security, and transatlantic digital integration.

Objective 1: Create a safe, trusted environment to accelerate the development of people, processes, and technology to support cybersecurity across CI sectors and assets in Ukraine.

Objective 2: Strengthen Ukraine as a sovereign nation built on a secure, protected, and dynamic economy, supported by a talented pool of human capital.

Objective 3: Stimulate demand for and supply of Ukrainian cybersecurity solutions and service providers to empower, equip, and finance cybersecurity entrepreneurs and businesses

The CCI Activity consists of three complementary, mutually reinforcing, and integrated components:

Component 1: Strengthen the Cybersecurity Enabling Environment

Component 2: Develop Ukraine’s Cybersecurity Workforce

Component 3: Build a Resilient Cybersecurity Industry

JOB DESCRIPTION:

Under the leadership of the Cybersecurity Enabling Environment Lead, Component 1 will enhance Ukraine’s ability to protect and modernize its civilian digital infrastructure by embedding U.S. and allied cybersecurity standards into the governance, architecture, and operational systems of critical infrastructure (CI). It will prioritize the divestment from high-risk digital assets and the adoption of secure-by-design technologies that advance trusted supply chains, secure communications,and resilient public services,in line with U.S. strategic and commercial interests. Implementation under this component shall prioritize verifiable operational change on live systems and exclude advisory, planning, or roadmap-only outputs that do not result in deployed or enforced outcomes.

Component 1 will support designated Ukrainian institutions —primarily the Ministry of Digital Transformation (MDT) National Cybersecurity Coordination Center (NCSCC),National Security and Defense Council (NSDC), and other authorized agencies— in implementing defined, outcome-oriented civilian cyber governance actions. Such support shall focus on the execution of approved institutional changes,the enforcement of coordination protocols, and the operational application of national cyber incident management procedures, rather than on the production of advisory or conceptual guidance.

To strengthen national preparedness, Component 1 will provide continuous support to critical infrastructure cyber posture assessment and remediation activities, including penetration testing and follow-on remediation tied to identified vulnerabilities, consistent with Ukraine’s national cyber incident management framework. These activities shall focus on improving real-world defensive readiness rather than exercise-based simulation.

TASKS / RESPONSIBILITIES:

The Cybersecurity Enabling Environment Lead will serve as the primary Technical Lead for Component 1 and ensure delivery of fixed-fee and implementation-plan deliverables focused on institutional reform,trusted vendor transition, critical infrastructure modernization, and cyber preparedness. The Lead must possess a deep understanding of Ukraine’s legislative and regulatory cyber framework, multilateral coordination platforms (e.g., Tallinn Mechanism), and U.S. technology and export compliance priorities.

Responsibilities include guiding policy alignment with U.S. standards (e.g.,NIST 800 series, C-SCRM), developing national frameworks for secure drone integration and AI threat modeling, and managing cross-government consultations on cyber resilience and minerals corridor protection. The Lead must work closely with GOU stakeholders (MDT,NSDC,SSSCIP),coordinate secure software transitions, and ensure forward-leaning support for pilot innovations such as digital twins and AI cyber labs.

The Cybersecurity Enabling Environment Lead will be responsible for:

• Serving as the primary Technical Lead for Component 1,providing strategic and technical leadership for all activities related to cybersecurity enabling environment and institutional reform.
• Leading the planning, implementation, and quality assurance of all Component 1 fixed-fee milestones and implementation-plan deliverables, ensuring they are completed on schedule and meet contractual requirements.
• Providing technical leadership on strengthening Ukraine’s cybersecurity governance, institutional capacity, and regulatory framework in alignment with Government of Ukraine priorities and international best practices.
• Advising Government of Ukraine counterparts on the development and implementation of cybersecurity legislation, regulations, standards, and national strategies consistent with internationally recognized frameworks, including the NIST Special Publication 800 Series and Cyber Supply Chain Risk Management (C-SCRM) principles.
• Supporting the transition from untrusted technologies and vendors to secure, trusted technology ecosystems by developing technical roadmaps, implementation guidance, and policy recommendations.
• Leading technical efforts to modernize cybersecurity protections for critical infrastructure sectors, with particular emphasis on strategic digital infrastructure, communications networks, and critical minerals supply chain corridors.
• Developing national-level frameworks and technical guidance for the secure integration of emerging technologies, including unmanned aerial systems (UAS), artificial intelligence, digital twins, and other advanced digital capabilities.
• Guiding the development of AI cybersecurity risk management methodologies, including AI threat modeling, secure AI adoption practices, and governance frameworks.
• Coordinating cross-government consultations and technical working groups involving key Government of Ukraine institutions, including the Ministry of Digital Transformation (MDT), the National Security and Defense Council (NSDC), the State Service of Special Communications and Information Protection (SSSCIP), and other relevant ministries and agencies.
• Providing technical oversight for secure software modernization initiatives, including migration planning, software assurance, secure development practices, and trusted software procurement.
• Supporting the design, implementation, and evaluation of cybersecurity pilot initiatives, including AI cyber laboratories, digital twin applications, secure innovation sandboxes, and advanced cyber resilience demonstrations.
• Ensuring all technical recommendations comply with applicable U.S. technology security, export control, and supply chain risk management requirements.
• Identifying cybersecurity policy,institutional,operational,and implementation risks, and develop mitigation strategies to support successful project execution.
• Preparing high-quality technical reports,implementation plans,policy briefs,and strategic recommendations for the client,Government of Ukraine counterparts, and other stakeholders.
• Providing technical supervision, mentoring, and quality control for cybersecurity experts, consultants,and subcontractors supporting Component 1 activities.
• Monitoring emerging cybersecurity threats, evolving international standards, and technology trends,incorporating relevant lessons learned and best practices into project implementation.
• Representing the project in high-level technical meetings, policy dialogues,donor coordination forums,and stakeholder consultations related to cybersecurity resilience and digital transformation.
• Performing other technical and managerial duties necessary to achieve Component 1 objectives and overall project goals as requested by the COP

Oversight and Leadership:

• Managing a team of 3−5 senior staff members
• Managing and guiding STTAs who support Component 1;reviewing the quality of completed work and providing constructive feedback as needed.
• Participating in weekly internal and client calls.
• Engaging in proactive and overarching coordination and discussion with other component leads.
• Attending meetings and events related to Component 1 as the Activity’s representative.

Required Qualifications:

1. Advanced degree in cybersecurity policy,digital governance,public administration,or related field.
2. Minimum 7 years' experience advising or managing technical policy reform in cybersecurity or digital infrastructure sectors,preferably in post-conflict or transitional contexts.
3. Demonstrated experience aligning cyber reform with U.S. and NATO/EU regulatory frameworks (e.g.,5G Toolbox,CISA guidelines).
4. Proven capacity to lead multi-stakeholder planning,including with GOU agencies and international donors.
5. Fluency in English and Ukrainian is required.

Equal Employment Opportunity

All qualified applicants will receive consideration for employment without regard to race,color,religion,sex,sexual orientation,gender identity,national origin,disability,age,or status as a protected veteran.All our positions are therefore subject to stringent vetting and reference checks. Only short-listed candidates will receive notice requesting additional information. Interviews will be conducted on the rolling basis.Kyiv-based,long-term.