Two Digital Security Experts for Training and Implementation under WeYouth’s Digital Resilience Project

1. Background and Context

WeYouth Organization is a non-governmental, non-profit, and non-political organization established in 2013. Its mission is to foster the autonomy, participation, and leadership of young people in Tunisia. WeYouth works in several strategic areas, including civic engagement, peacebuilding, gender equality and social inclusion, youth economic empowerment, and education.

WeYouth is implementing an 8-month project aimed at building its digital resilience by integrating sustainable, standards-based security practices into its day-to-day operations. The project responds to an increasingly hostile civic space in Tunisia, where rights-based and youth organizations face growing digital risks including surveillance, phishing, data leaks, and identity-based digital targeting.

To this end, WeYouth seeks to contract two digital security experts (one technical and one strategic/policy expert) to lead an intensive six-month training and implementation program for approximately 20 members of its staff.

2. Purpose of the Consultancy

To provide specialized technical and strategic expertise to design and deliver a comprehensive digital security training and capacity-building program, accompanied by hands-on implementation support to embed security practices into the organization’s workflows, including the development of a sustainable organizational Information Security Policy (ISP).

3. Key Tasks and Responsibilities

The two experts will be jointly responsible for the following tasks:

• Conduct a baseline digital security assessment of WeYouth during the first month of the contract
• Design and develop detailed training content for 12 sessions (2 per month over 6 months), covering the following thematic areas:
•    – Threat modeling and organizational risk assessment
•    – Device and communication hygiene (2FA, encryption, secure messaging tools)
•    – Data classification, file protection, and backup strategies
•    – Secure communication and incident response/crisis communication
•    – Data protection laws (GDPR and the Tunisian PDPL)
•    – Participatory development of an organizational Information Security Policy (ISP)
•    – Secure handling of digital assets and workflows for video/media teams
•    – Case studies and cybersecurity crisis simulation scenarios
• Deliver training sessions directly (in person or remote) to approximately 20 staff members from the communication, video production, and initiative management departments
• Provide hands-on implementation support following each training module, including support for rolling out password and 2FA policies, deploying encrypted backup servers, running phishing simulations, and reorganizing the secure digital media archive
• Lead the participatory design of a customized Information Security Policy (ISP), aligned with ISO 27001 and ENISA standards
• Conduct pre- and post-training assessments to measure participants’ knowledge gains, and analyze the results
• Organize a simulated mini cybersecurity crisis in Month 7 and assess the team’s response
• Conduct the final internal audit and prepare a roadmap for the sustainability of security practices beyond the project period
• Prepare a final toolkit including incident response templates, data/asset handling checklists, and internal audit tools
• Prepare a final technical report summarizing activities, results, and recommendations, and submit it to the Project Lead
• Contribute to the design of a visual “security culture” campaign (posters, infographics, recurring tips) for internal dissemination

4. Expected Deliverables

• A detailed training and implementation plan approved by WeYouth (Month 1)
• A baseline assessment report on the organization’s digital security posture
• 12 training sessions delivered, with accompanying training materials and attendance records
• A completed Information Security Policy (ISP), approved by leadership and signed by staff
• Operational security infrastructure (backup, secure storage, encrypted communication tools), documented in an implementation report
• Pre- and post-assessment reports for each training module
• A final internal audit report and sustainability roadmap
• A final toolkit (response templates, checklists, audit tools)
• A comprehensive final technical report

5. Required Qualifications and Experience

Expert 1 (Technical):

• At least 5 years of experience in cybersecurity or information security, preferably within civil society or NGO contexts
• In-depth knowledge of ISO 27001, the NIST Cybersecurity Framework, and ENISA guidelines
• Hands-on experience deploying encryption tools, backup servers, and secure communication systems
• Familiarity with civil-society-oriented digital security resources (Access Now, Front Line Defenders, Internews, Tactical Tech)

Expert 2 (Strategic/Policy):

• At least 5 years of experience in security governance, policy development, and data protection law (GDPR and equivalents)
• Knowledge of the Tunisian legal framework on personal data protection
• Experience designing and facilitating capacity-building programs for civil society organizations
• Demonstrated sensitivity to gender, equity, and inclusion considerations, with experience integrating them into capacity-building programs

Joint Requirements:

• Fluency in Arabic and English (written and spoken); knowledge of French is an asset
• Strong facilitation and communication skills with diverse, non-technical audiences
• Ability to work both independently and as part of a team, and to meet the project’s set timeline
• Commitment to human rights principles, gender equality, and inclusion

6. Duration of Engagement and Contracting Modality

The engagement spans betwen for & six months, at a rate of two training sessions per month plus the implementation support days required to operationalize each training module. Contracting will take the form of a Consultancy Service Agreement, with a payment schedule linked to the completion of the deliverables specified above.

7. Monitoring and Evaluation Arrangements

• Brief monthly progress reports submitted to the Project Lead, documenting activities carried out and progress achieved
• Regular check-in meetings with the Project Lead and WeYouth team
• Performance assessed against project indicators, notably: staff attendance rate (minimum 85%), post-training knowledge improvement (minimum 40%), and staff adoption rate of new security practices (minimum 80%)

8. How to Apply

Interested candidates are requested to submit the following documents:

• A detailed CV highlighting relevant experience
• A brief technical proposal outlining the proposed training and implementation methodology
• A financial proposal (expert fees for the full contract duration)
• Samples of previous work or references from past clients (civil society sector experience preferred)

Applications should be sent to 

📧 hsbiha@weyouthorganization.org
📧 zkdhira@weyouthorganization.org

 Apply before 12.07.2026

Note: Only shortlisted candidates will be contacted. 

Applications may be submitted by an individual consultant or a team of two consultants. Applicants may apply for one or both consultancy positions and should clearly indicate the role(s) they are applying for in their application.