Senior Agent – Cybersecurity Awareness (FGIV), Security Risk Management & Services Unit

This selection procedure is intended to establish a reserve list of successful candidates. It is envisaged to start using the reserve list in Q4 2026/Q1 2027.

Europol retains the right to make use of the reserve list to select candidates for similar posts within the organisation, should business needs require so.

1. Organisational context

Organisational setting:

The post of Senior Agent – Cybersecurity Awareness is located in the Information Security Team, Corporate Security Department, Governance Directorate.

The Governance Directorate is responsible for supporting and assisting Europol Management and the rest of the organisation by providing advice and maintaining strategic links with relevant EU bodies and law enforcement agencies of the Member States. Maintaining close cooperation with other directorates, particularly on key corporate matters and monitor business planning and performance management, are also among the Directorate’s task. Additionally, the Governance Directorate is responsible to ensure Europol’s physical and information security and business continuity. The Governance Directorate comprises of two Departments, Institutional and Legal Affairs and Corporate Security.

The Corporate Security Department establishes all security measures required to protect the persons present at Europol, the Europol buildings, together with its installations and all Europol information, and to ensure the safe and continual operational functioning of Europol. Furthermore, the Department handles the integral management (planning and monitoring) and realization of housing services and resources.

The Security Risk Management & Services Unit, bringing together all services delivered across the organisation to protect information, enhance organisational resilience, manage crises, provide risk-based assessments and advice to relevant stakeholders and deliver directly related facilities services.

The Information Security Team is responsible for:

• Ensuring that Information Security risks are well managed;
• Providing assurance in Europol’s Communication and Information Systems;
• Monitoring the Cyber Threat Landscape and reporting on current and emerging threats;
• Developing and maintaining the information security policy framework;
• Ensuring compliance of Information Security measures with applicable legal framework;
• Coordinating Training and Awareness on Information Security;
• Providing expert advice on Information Security matters to Europol’s management, projects and user community.

Purpose of the post:

The Senior Agent – Cybersecurity Awareness contributes to the activities and objectives of the Information Security Team with a primary focus on strengthening cybersecurity awareness. The post holder leads the development, implementation and continues improvement of cybersecurity awareness services, ensuring their development towards increased maturity, effectiveness and organisational relevance. The role focuses on the planning, coordination and implementation of cybersecurity awareness initiatives and projects, by designing, coordinating and delivering risk-based cybersecurity awareness, education and training programmes that enhance cybersecurity culture, knowledge, skills and behaviours among staff and relevant stakeholders.

Reporting lines:

The incumbent reports to the Head of the Information Security Team.

2. Functions and duties

The incumbent carries out the following main functions and duties:

• Develop, maintain and continuously improve Europol’s cybersecurity awareness and training programme in line with applicable information security policies, standards, regulatory requirements, organisational risks and current threat landscape;
• Design, coordinate and deliver targeted cybersecurity awareness campaigns, training activities, workshops, seminars and engagement initiatives to strengthen cybersecurity knowledge, skills and secure behaviours across Europol;
• Develop, update and maintain cybersecurity awareness training materials across a variety of formats;
• Plan and execute phishing simulation exercises, analyse results and identify training needs to inform campaign priorities;
• Collaborate with internal stakeholders to integrate cybersecurity awareness into onboarding, staff development activities and wider organisational security initiatives;
• Monitor, evaluate and report on the effectiveness of cybersecurity awareness and training activities using defined metrics, KPIs and assessment methods, providing recommendations to the management;
• Support the development and maintenance of information security policies, procedures and guidance related to staff cybersecurity responsibilities and human-factor risks;
• Assess and support the use of cybersecurity awareness platforms, learning management systems (LMS), content creation tools, multimedia production tools and other technologies supporting awareness activities;
• Follow developments in cybersecurity threats, awareness practices and training approaches and contribute to the continuous improvement of awareness activities;
• Liaise with EU institutions, agencies, law enforcement partners and relevant external bodies to exchange knowledge and promote cybersecurity awareness best practices;
• Perform any other duty in the area of competence as assigned by line management.

3. Requirements - Eligibility criteria

a. Candidates must

• Be a national of one of the Member States of the European Union and enjoy full rights as a citizen;
• Have fulfilled any obligations imposed by the applicable laws on military service;
• Produce appropriate character references as to his or her suitability for the performance of the duties;
• Be physically fit to perform the duties pertaining to the position (prior to appointment the successful candidate will be medically examined by one of the institution’s medical officers in order that the institution may be satisfied that the candidate fulfils the requirements of Article 12(2)(d) of the Conditions of Employment of Other Servants of the European Union (CEOS);
• Produce evidence of a thorough knowledge of one of the languages of the Union and a satisfactory knowledge of another language of the Union to the extent necessary for the performance of the duties.

b. Candidates must have

• Have a level of education which corresponds to completed university studies attested by a diploma when the normal period of university education is 3 years or more;

OR

• Professional training of an equivalent level, and after having completed the training, at least the number of years of relevant professional experience as indicated below:

Duration of professional training Additional professional experience required

More than 6 months and up to 1 year 3 years

More than 1 year and up to 2 years 2 years

More than 2 years 1 year

4. Requirements - Selection criteria

a. Professional experience:

Essential:

• Experience in planning, designing, developing and implementing cybersecurity awareness, education or security training programmes and/or campaigns;
• Experience in developing cybersecurity awareness content and training materials for diverse audiences, including non-technical users, using different formats;
• Experience in planning and executing social engineering awareness exercises (e.g. phishing simulations), analysing results and using findings to support behavioural change and risk reduction;

Desirable:

• Experience in working in an international work environment;
• Experience with e-learning platforms or learning management systems (LMS);
• Experience in applying behavioural science, adult learning principles or change management approaches to security awareness activities.

b. Professional knowledge:

Essential:

• Knowledge of cybersecurity principles, cyber threats and attack vectors, including phishing, social engineering and malware, insider threat and human-factor risks;
• Knowledge of cybersecurity awareness methodologies, behavioural change principles and best practices;
• Ability to develop and produce security awareness materials in different formats; (e.g. graphic content);
• Knowledge of applicable EU regulatory and policy frameworks for cybersecurity, including Regulation (EU, Euratom) 2023/2841 (EU Cybersecurity Regulation for Union entities);
• Knowledge of metrics and performance measurement techniques used for measuring the effectiveness of cybersecurity awareness initiatives.

c. General competencies:

Essential:

Communicating:

• Very good communication skills in English, both orally and in writing.
• Very good drafting skills and attention to detail.

Analysing & problem solving:

• Keen eye for detail with the ability to maintain standards of accuracy under pressure of tight deadlines.
• Strong analytical and problem-solving skills including the ability to anticipate potential problems, determine and implement solutions.
• Competent user of Microsoft Office applications (MS Word, Excel, PowerPoint and Outlook) and the internet.

Delivering quality and results:

• High degree of commitment and flexibility.
• High level of customer and service-orientation.

Prioritising and organising:

• Good administrative and organisational skills.

Resilience:

• Ability to work well under pressure, both independently and in a team.
• Very good interpersonal skills, including the ability to effectively liaise with other departments, groups and teams as well as with external partners.

Living diversity:

• Ability to work effectively in an international and multi-cultural environment.

5. Selection procedure

All applications for Contract Agent posts must be submitted through the online recruitment system accessible via Europol’s website.

The Authority Authorised to Conclude Contracts of Employment (AACC) sets up a Selection Committee, composed of at least three members, consisting of one chair and at least one member from the Administration of Europol and one member designated by the Staff Committee.

The selection criteria, set out in this Vacancy Notice, will be assessed by the Selection Committee throughout the different stages of the selection procedure. Before the start of the selection procedure, the Selection Committee will decide which selection criteria will be used at each stage of the selection procedure. Certain selection criteria will be assessed only for shortlisted candidates during a written test and/or a competency-based interview.

The Selection Committee will assess the applications received in order to make an initial selection of those candidates meeting all eligibility criteria and matching best the selection criteria (suitability).

The minimum pass-mark for being shortlisted, i.e. invited to participate in a post-related selection procedure, consisting of a written test and a competency-based interview, is established as 60% of the total maximum score.

The Selection Committee will shortlist the 6 highest scoring candidates. All candidates having a score equal to the 6th highest scoring candidate will be invited to take part in the selection procedure. At shortlisting stage, the Selection Committee will establish the pass-mark for the selection procedure.

It is intended for the selection procedure to be conducted remotely. Should the Selection Committee consider it necessary to conduct the selection procedure on-site at Europol in the interest of the proceedings, and subject to budget availability, the candidates invited to participate in the selection procedure will be informed accordingly.

After the selection procedure has taken place, the Selection Committee will establish a list of successful candidates, i.e. those scoring above the pre-defined pass-mark, which is shared with the AACC, for establishment of a Reser