Secure survivor registry, Sudan

You will make the system defensible against well-resourced attackers and against the seizure of field devices. You will own the security architecture from design to go-live, then review it during operations.

Responsibilities

• Lead the threat model and the security baseline: encryption in transit and at rest, key management, multi-factor authentication, role-based access, separation of duties and tamper-evident audit logging.
• Define how field devices are hardened, remotely disabled and purged after sync.
• Set secure development practices (code review, dependency and vulnerability scanning) and review critical changes.
• Scope and manage the independent penetration test, then verify the fixes.
• Write the incident-response plan and runbooks; lead quarterly security reviews.

Required

• At least 7 years in security engineering or security architecture for web or cloud systems.
• Hands-on experience with cloud security, encryption and key management, identity and access management, and secure development.
• A recognised certification such as CISSP, CISM, OSCP, ISO 27001 Lead Implementer or Lead Auditor, or a major cloud security certification.
• Fluent English.

Desirable

• Securing systems for civil-society, human-rights or humanitarian organisations against state-level threats.
• Mobile device security; GDPR.

You must be independent of any firm proposed to carry out the penetration test.

You will provide independent assurance that the system works correctly in Arabic and English, offline and online, at scale, and fails safely.

Responsibilities

• Write the test strategy and plan; build realistic synthetic test data (no real personal data is ever used in testing).
• Run functional, regression and API tests, including Arabic right-to-left display and offline/sync failure scenarios.
• Coordinate user acceptance testing with the client's staff.
• Run load and capacity tests up to hundreds of thousands of records; witness backup-restore tests.
• Track defects and sign off releases.

Required

• At least 5 years in QA for web or mobile applications.
• Test automation (for example Playwright or Cypress), API testing and performance testing.
• Experience testing localised or right-to-left interfaces.
• Fluent English.

Desirable

• Ability to read Arabic.
• Offline-first applications; humanitarian or public-sector systems.

You will make sure staff of Sudanese civil-society organisations can use the system safely and confidently, and you will run user support once it is live.

Responsibilities

• Assess training needs by role: administrators, data collectors, caseworkers and registry officers.
• Design and deliver training-of-trainers and role-based training, including safe device handling and offline/sync procedures.
• Write user guides in Arabic and English.
• Run the support desk: ticketing, first-line response, escalation, and reporting against service levels.
• Feed user feedback into improvements.

Required

• Fluent Arabic and English. Sudanese Arabic is a strong advantage.
• At least 5 years training staff on digital case-management or data-collection systems (for example Primero, KoBo/ODK, CommCare or DHIS2) in humanitarian or protection settings.
• Experience designing training-of-trainers and writing user documentation.

Desirable

• GBV or protection programming; digital-safety training.
• Experience working with Sudanese civil-society organisations.

Sudanese nationals are strongly encouraged to apply.

You will make sure survivors' decisions shape what the system collects, how consent works, and how survivors are treated throughout. You will bridge survivors, field partners and the technical team.

Responsibilities

• Co-design and co-facilitate the survivor co-creation workshop and follow-up consultations, together with the client and its Sudanese partners.
• Turn survivor input into clear options and simple prototypes that non-technical participants can assess.
• Keep the decision log that traces each design decision back to survivor input.
• Design trauma-informed intake that avoids asking survivors to repeat their experiences.
• Review workflows and prototypes for risks of harm or re-traumatisation.

Required

• Fluent Arabic and English.
• At least 7 years in GBV case management or survivor-centred programming.
• Experience facilitating participatory or co-design processes with survivors.
• Strong grounding in trauma-informed practice, safeguarding and PSEA.
• Good knowledge of the Sudan context.

Desirable

• Transitional justice or reparations.
• Translating user needs into requirements for digital systems.

Given the nature of this work, women candidates and Sudanese nationals are strongly encouraged to apply.

You will make sure every aspect of data handling meets GDPR-aligned standards, the Murad Code and do-no-harm principles.

Responsibilities

• Lead the data protection impact assessment.
• Advise on the data-processing agreement and the list of sub-processors.
• Set rules for data minimisation, classification, retention, suspension and deletion.
• Design granular, revocable and age-appropriate consent, together with the co-creation lead.
• Set rules for sharing data with referral services.
• Review workflows, notifications and exports so that nothing reveals that a person is a survivor.
• Oversee breach governance and notification.

Required

• At least 5 years in data protection, including impact assessments, processing agreements and retention policies.
• A data-protection certification (for example CIPP/E or CIPM) or a legal qualification in data protection.
• Experience in safeguarding and PSEA policy.
• Fluent English.

Desirable

• Humanitarian data protection (for example the ICRC Handbook on Data Protection in Humanitarian Action).
• The Murad Code; Swiss data protection law; GBV or CRSV data.

You will build and run the infrastructure and keep the system healthy, patched and recoverable. You will also act as the second developer, able to step in for the lead developer.

Responsibilities

• Set up infrastructure as code, environments and automated build/deployment pipelines (CI/CD) in the client's cloud account (EU or Switzerland).
• Set up monitoring and alerting for application health, sync failures and suspicious logins.
• Run backups and regularly test restores.
• Patch and harden the operating system, databases and application.
• Share an on-call rota covering European and East African hours.
• Contribute to development and bug fixing.

Required

• At least 5 years in DevOps or backend development.
• Node.js/TypeScript, MongoDB and Elasticsearch.
• Linux, Docker, and infrastructure as code (for example Terraform or Ansible).
• Monitoring, backup/restore and security hardening.
• Fluent English.

Desirable

• Experience operating open-source platforms for civil-society or humanitarian organisations.
• Offline sync; GDPR-compliant operations.

You will make sure the system and its materials read naturally and sensitively in Sudanese Arabic.

Responsibilities

• Translate interface text, forms, user guides and training materials from English into Arabic.
• Build a glossary of sensitive terminology.
• Check that labels, notifications and file names do not reveal that a person is a survivor.
• Review right-to-left display with the QA lead.

Required

• Native Arabic speaker with strong knowledge of Sudanese Arabic.
• Professional translation experience, including software localisation.
• Sensitivity to GBV and protection terminology.

Desirable

• Humanitarian or protection translation work.