Cyber Security and Forensics Specialist (3 posts)

Job Requisition ID: 20632

Closing Date: 2 July 2026 23:59 CET/CEST

Establishment: ESRIN, Frascati, Italy

Directorate: Resources and Services

Publication: Internal & External

Type of Appointment: Local Staff

Date Posted: 11 June 2026

This is a 4-year appointment, which can be extended for an indefinite duration depending on performance.

Location
ESRIN, Frascati, Italy or ESEC, Redu, Belgium

Description

As Cyber Security and Forensics Specialist, you will be a senior member of ESACERT, ESA's Computer Emergency Response Team.

ESACERT is one of the services provided by the central IT Department at ESA. It is part of the IT Security Section, which in turn is part of the Security and Shared Infrastructure Services Division.

ESACERT forms an important part of ESA's Cyber Security Operations, together with C-SOC. While C-SOC has a focus on continuous monitoring, detection, initial and automated response, ESACERT focuses on incident response, forensic analysis, threat intelligence, pen testing, incident response procedure definitions and investigations.

Duties

Your tasks and responsibilities will include:

acting as technical incident handling coordinator for medium- and high-severity security incidents;
prioritising, executing or coordinating the required incident response actions aligned with main stakeholders such as security officers, system owners, system administrators, business owners and the ESA Security Office;
ensuring proper registration of all incident handling steps in incident handling reports and providing timely updates to stakeholders;
defining proper recovery plans agreed with stakeholders and ensuring they are properly understood and tracked;
participating in lessons learned exercises feeding back into overall security governance processes in view of continuous improvement;
defining and/or contributing to security awareness sessions/campaigns;
leveraging threat intelligence: deriving actions or campaigns and delivering reports to various stakeholders;
executing or coordinating and assessing Security Testing Campaigns (penetration tests, source code analysis, threat hunting, ...) and defining and following up on the resulting actions;
defining and continuously improving incident handling procedures and playbooks in strong collaboration with C-SOC;
acting as a forensics specialist supporting investigations (triggered by Internal Audit, Human Resources, Legal);
supporting any other task assigned to ESACERT;
acting as advisor on cyber security and related technical matters that may be referred to you;
contributing to the IT Security Section's work and objectives;
any other related tasks.

Technical competencies

Cyber Incident Handling (categorisation, response, reporting)

Forensic Analysis (collection, identification, extraction, analysis)

Threat Intelligence

Advanced Security Testing

Ethical Hacking

Behavioural competencies

Result Orientation
Operational Efficiency
Fostering Cooperation
Relationship Management
Continuous Improvement
Forward Thinking

For more information, please refer to the ESA Core Behavioural Competencies guidebook

Education and professional experience

A vocational qualification (EQF level 5) in Operations Cyber Security is required for this post.

Additional requirements

The selected candidates will be part of an on-call set-up, requiring regular weekly on-call duties as Technical Incident Handling Coordinator.
Experience working in an international context is considered a strong asset.
Experience working in the space sector is considered an asset.

Diversity, Equity and Inclusiveness
ESA is an equal opportunity employer, committed to achieving diversity within the workforce and creating an inclusive working environment. We therefore welcome applications from all qualified candidates irrespective of gender, sexual orientation, ethnicity, religious beliefs, age, disability or other characteristics.

At the Agency we value diversity, and we welcome people with disabilities. Whenever possible, we seek to accommodate individuals with disabilities by providing the necessary support at the workplace. The Human Resources Department can also provide assistance during the recruitment process. If you would like to discuss this further, please contact us via email at contact.human.resources@esa.int.

Important Information and Disclaimer
In principle, recruitment will be within the advertised grade band (A2-A4). However, if the selected candidate has less than four years of relevant professional experience following the completion of the master’s degree, the position may be filled at A1 level.

Applicants must be eligible to access information, technology, and hardware which is subject to European or US export control and sanctions regulations & eligible to acquire the security clearance by their national security administrations.

During the recruitment process, the Agency may request applicants to undergo selection tests. Additionally, successful candidates will need to undergo basic screening before appointment, which will be conducted by an external background screening service, in compliance with the European Space Agency's security procedures.

Note that ESA is in the process of transitioning to a Matrix setup, which could lead to organisational changes affecting this position.

The information published on ESA’s careers website regarding working conditions is correct at the time of publication. It is not intended to be exhaustive and may not address all questions you would have.

Nationality and Languages
Please note that applications are only considered from nationals of one of the following States: Austria, Belgium, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Luxembourg, the Netherlands, Norway, Poland, Portugal, Romania, Slovenia, Spain, Sweden, Switzerland, the United Kingdom and Canada, Latvia, Lithuania and Slovakia.

According to the ESA Convention, the recruitment of staff must take into account an adequate distribution of posts among nationals of the ESA Member States*. When short-listing for an interview, priority will first be given to internal candidates and secondly to external candidates from under-represented Member States*.

The working languages of the Agency are English and French. A good knowledge of one of these is required. Knowledge of another Member State language would be an asset.

*Member States, Associate Members or Cooperating States.

Apply on Organization Website

Similar Jobs