Key Skills

Job Description

Applications are currently being accepted for the position of full-time Cybersecurity Officer at the International Bureau of the Permanent Court of Arbitration (PCA). The successful candidate will be responsible for protecting the organization’s information assets from cyber threats and ensuring the confidentiality, integrity, and availability of its information technology systems. The PCA is an international organization specialized in the resolution, through legal and diplomatic procedures, of international disputes involving states, state entities, and international organizations. Founded in 1899 and based in the Peace Palace in The Hague, the PCA operates globally and maintains international offices in Argentina, Austria, Mauritius, Singapore, and Viet Nam. The PCA is comprised of approximately 90 legal and administrative staff, fellows, and interns of various nationalities. The PCA IT team presently comprises two IT Officers and a Cybersecurity Officer, as well as various external contractors. The PCA operates a hybrid IT environment that is largely on-premises, with limited cloud services and high security requirements in light of the diplomatic and political sensitivity of the matters handled by the organization. Duties Within a small organization, the role of Cybersecurity Officer merges elements of hands-on infrastructure oversight (Technical ISO) with elements of strategic policy development (ISO). The successful candidate will be willing and able to embrace both aspects of the position. The duties and responsibilities of the Cybersecurity Officer will include: Core Oversight and Risk Management: Compliance and Internal Monitoring: Measuring and monitoring the compliance of IT infrastructure, systems, and information management practices against established frameworks and institutional security policies; reporting risk posture directly to senior leadership. Vulnerability & Threat Assessments: Conducting regular, comprehensive threat, vulnerability and risk assessments across physical servers, networks, core data environments, and organizational processes; designing and implementing pragmatic remediation plans. Infrastructure Change Advisory: Assessing systemic risks relating to legacy system modernizations, hardware refreshes, and newly proposed software architectures under consideration by the organization, proposing technical risk-reduction measures. System Architecture and Improvements: Continuously evaluating and proposing enhancements to internal security architectures, defense-in-depth baselines, and data protection policies. Vendor and Contractor Steering: Managing and providing oversight for specialized external security contractors, third-party technical vendors, and auditors. Governance, Policy, and Security Culture (in coordination with senior leadership): Policy Development & Architecture: Advising and assisting on the drafting, maintenance, and structural updates of the organization’s information security architecture, information security policies, and operational procedures. Awareness & Training: Designing and delivering customized security awareness programs and training to foster a resilient security culture across all levels of the international staff. Audits & Compliance Reviews: Directing and coordinating periodic internal and external security audits, configuration reviews, and risk exception workflows. Technical Control & Operational Resilience (steering and coordinating external security contractors): Hardened Technical Safeguards: Ensuring that critical technical controls—including enterprise firewalls and strict access controls—are optimally configured and maintained. On-Premises Infrastructure Monitoring: Overseeing the active logging and continuous monitoring of local systems and network boundaries to ensure compliance, usage accountability, and early identification of threat indicators. Incident Response and Forensics: Investigating security alerts, orchestrate incident response, leading mitigation efforts during potential containment operations, and compiling forensic post-incident analyses. Qualifications and Experience The ideal candidate for this position is professional, reliable, and trustworthy and would have: Education: Advanced university degree in information / cyber security, information systems, computer science or related field. A first-level university degree in combination with two additional years of qualifying experience is accepted in lieu of the advanced university degree. Experience: A minimum of five years (seven years with first level university degree) of progressively responsible professional experience in the information security field with a strong practical emphasis on designing, implementing and operating cost-effective information security-related technologies and systems is required. Knowledge, skills, and abilities: In-depth understanding of recognized security governance frameworks and their translation into local infrastructure. Practical technical competency in auditing or engineering on-premises enterprise environments. Excellent interpersonal and communication skills, with a proven ability to translate complex technical concepts and infrastructure risks into clear, actionable business insights for senior leadership. Strong organizational and time-management skills, with a proven ability to self-direct and balance conflicting, complex priorities under time pressure. A flexible mindset with the capability to easily pivot from high-level policy issues to auditing live technical configurations. Knowledge of languages: Fluency in written and spoken English is required. Knowledge of Dutch or other UN languages may be considered an asset. This position is based in The Hague, the Netherlands. Occasional travel to the PCA’s international offices in connection with specific projects may be required. The PCA is an international organization and staff enjoy privileges and immunities in the Netherlands. Remuneration is in accordance with the Co-ordinated Salary Scale for the Netherlands including a salary exempt from Dutch income tax. Interested applicants should send a cover letter and CV by e-mail to: recruitment‑recrutement@pca‑cpa.org The subject line of the email should include “Cybersecurity Officer Recruitment”. The deadline for applications is 30 November 2026. Recruitment Policy The PCA recruits and employs staff based on the highest standards of competence, integrity, and efficiency. Vacant posts are filled by nationals of Contracting Parties based on the needs and available resources of the organization, particularly in relation to the nature and size of the PCA’s caseload, which can vary from year to year. Due regard is given to maintaining an appropriate mix of men and women, and the need to seek geographical diversity in order to maintain the international character of the institution. Only applicants invited for an interview will be contacted.

Core Responsibilities

Oversee cybersecurity risk, compliance, infrastructure security, and security architecture, including assessments, remediation planning, audits, and oversight of external contractors. Develop security policies and awareness programs, monitor on-premises systems, and lead incident response and post-incident analysis.

Requirements

Requires an advanced university degree in information or cybersecurity, information systems, computer science, or a related field; a first-level university degree plus two additional years of qualifying experience is accepted instead. Candidates need at least five years of progressively responsible information security experience, practical expertise with on-premises enterprise environments and security frameworks, strong communication and organizational skills, and fluency in written and spoken English.

Benefits

• Privileges and Immunities in the Netherlands
• Salary Exempt from Dutch Income Tax