Consultant – Data protection \ Information Security consultant (International - HQA)

Overview

The consultant will support the development, implementation, and continuous improvement of cybersecurity operations and vulnerability management frameworks, ensuring alignment with international standards and organizational policies.

Tasks Summary

• Conduct a comprehensive mapping of digital systems and data flows within Education and Health programs.
• Document types of personal and sensitive data collected, processed, stored, and shared.
• Identify third-party systems or integrations and assess associated data protection risks.
• Perform gap analyses against UNRWA’s Data Protection Policy and international standards.
• Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
• Identify vulnerabilities and recommend mitigation strategies.
• Translate policy requirements into practical guidance for program and IT teams.
• Develop templates, checklists, and SOPs to support compliance.
• Advise on privacy-by-design and data minimization strategies.
• Deliver tailored training sessions and awareness materials for Education and Health staff.
• Build capacity for field-level personnel to manage data responsibly and securely.
• Prepare reports and presentations for internal stakeholders and donors (e.g., KfW).
• Coordinate with legal, ethics, and program teams to ensure integrated approaches.
• Participate in relevant inter-agency or donor coordination platforms as needed.

Experience Requirements

• A minimum of five (5) years of progressively responsible experience in information security, or data protection including at least two (2) years of active leading data protection assessment.
• Unless currently serving as an international staff member in the UN Common System, candidates must have a minimum of two continuous years of relevant international experience gained outside UNRWA and outside the country(s) of citizenship.
• Experience with industry-standard security tools (e.g., SIEM, vulnerability scanners, EDR) is required.
• Experience working in a complex international environment or multilateral organization is desirable.
• Experience with scripting or automation (e.g., Python, PowerShell, Bash) is an advantage.
• Previous experience with implementing MITRE ATT&CK framework in the Security Operations and implementing Threat Intelligence programs.

Qualification Requirements

• Advanced university degree (Master’s or equivalent) in Information Technology, Law, Data Protection, Public Health Informatics, or related field. A first-level university degree in combination with two additional years of qualifying experience may be accepted in lieu of the advanced university degree.
• Certification in data protection/privacy (e.g., CIPP/E, CIPM, CDPO) is an asset.

Other Details

Languages Required: • Fluent in spoken and written English.

Languages Preferred: ● Fluency in spoken and written Arabic is a plus. • Experience working in a complex international environment or multilateral organization is desirable.

Contract Duration: up to 12 months

Work Modality:

Remuneration: • The selected candidate will receive a monthly remuneration that is equivalent to P3 Step 1 amounting to $7,924.25 for every fully completed month.