PAHO Consultant - Information Security Governance and Reporting Automation

OBJECTIVE OF THE OFFICE/DEPARTMENT

This is a requisition for employment at the Pan American Health Organization (PAHO)/Regional Office of the World Health Organization (WHO)

Contractual Agreement:

Non-Staff - International PAHO Consultant

Job Posting:

October 22, 2025

Closing Date:

October 28, 2025, 11:59 PM Eastern Time

Primary Location:

Off Site

Organization:

ITS Information Technology Services

Schedule:

Full time

PURPOSE OF CONSULTANCY

This requisition is for a consultancy at the Pan American Health Organization (PAHO)/Regional Office of the World Health Organization (WHO).
• Provide a short description of the objective of the office/department here.
• Provide a description of the purpose of the consultancy here.

DESCRIPTION OF DUTIES:

Information Security Consultant - Security Governance and Reporting Automation

PAHO is searching for an independent consultant to work at the Department of Information Technology Services (ITS), who will be responsible for the implementation of the following deliverables and activities within PAHO’s Information Security Program:

1. Background

The Pan American Health Organization (PAHO) is strengthening its Information Security Program to enhance the protection, integrity, and confidentiality of its digital assets, focusing on data protection, risk visibility, and automation of compliance across cloud and on-premises environments. To enable data-driven decision-making and maintain situational awareness of cybersecurity risks, PAHO requires integrated reporting and automation capabilities that consolidate information from multiple security platforms.

The Information Security Consultant - Security Governance and Reporting Automation will be responsible for developing, automating and maintaining governance and reporting tools that support oversight of vulnerabilities, incidents and data protection — transforming technical data into actionable intelligence that enhances organizational resilience and compliance.

2. Purpose of the Consultancy

To provide technical and analytical support to the Information Security Program, with a focus on cybersecurity governance, data protection oversight, vulnerability and incident reporting, and automation of dashboards and compliance metrics.

The consultant will enable data-driven governance and decision-making by automating the collection, correlation, and presentation of metrics from PAHO’s security platforms, strengthening operational maturity across the cybersecurity program.

3. Duties and Responsibilities

Under the supervision of the Information Security Advisor (CISO), the consultant will perform the following activities:

A. Data Security Governance and Emerging Technologies

• Support the design and implementation of data security governance processes, including classification, lifecycle management, retention, and secure disposal.
• Define and document data protection and access control requirements across cloud and collaboration platforms (Microsoft 365, SharePoint, Teams).
• Use tools such as AvePoint, Microsoft Purview, and Defender for Cloud Apps (CASB) to monitor and report on data exposure, access controls, and compliance posture.
• Apply Data Security Posture Management (DSPM) principles to continuously identify and monitor sensitive data, permissions, and movement across multi-cloud and hybrid environments.
• Support the CISO Team in establishing AI Governance practices, including secure data handling for AI models and monitoring of AI service integrations (e.g., Copilot, ChatGPT APIs).
• Develop automated reports on data-sharing risks, policy enforcement, and remediation aligned with ethical and regulatory requirements.
• Ensure that data protection and AI governance controls remain aligned with PAHO policies, digital ethics standards, and applicable data protection frameworks.

B. Compliance, Risk Monitoring, and Reporting Automation

• Implement automated dashboards and workflows to monitor compliance, risk, and security performance across PAHO’s cybersecurity domains.
• Integrate data from main PAHO’ security platforms (Qualys, Microsoft Sentinel, Entra, Purview, Intune, AvePoint, others) to consolidate visibility into vulnerabilities, incidents, and data protection posture.
• Maintain and update the ITS Risk Register by correlating vulnerability, incident, and compliance data in alignment with NIST CSF and CIS Controls.
• Develop reporting pipelines and automation scripts (Power Automate, Python, REST APIs) to ensure consistent and timely delivery of performance metrics.
• Automate compliance evidence generation for audits,