Long-Term Agreement (LTA) of Individual Consultant as SecureAccess and PKI Consultant, ICTD Digital Core, PSD, Hybrid: Valencia, Spain and Off-Site/Remote

UNICEF works in some of the world’s toughest places, to reach the world’s most disadvantaged children. To save their lives. To defend their rights. To help them fulfill their potential.

Across 190 countries and territories, we work for every child, everywhere, every day, to build a better world for everyone.

And we never give up.

For every child, a connected world

The overarching strategic goal of UNICEF’s Information and Communication Technology Division (ICTD) is to transform and build partnerships with our stakeholders to successfully implement UNICEF programmes globally through the use of innovative technology-enabled solutions.

UNICEF ICT CORE recognizes the need for secure remote access to its network resources and has identified the implementation of a robust and reliable VPN solution as a critical requirement. ICTD CORE has decided to engage a consultant to provide expertise in the areas of secure remote access, specifically in the implementation and management of Absolute Secure Access, Zero Trust Network Access (ZTNA), and Secure Socket Extension (SSE) and Secure Access Service Edge (SASE) frameworks. Experience with Microsoft Always On VPN and Microsoft DirectAccess is desirable, Additionally, the organization aims to maintain a robust Public Key Infrastructure (PKI) through the utilization of Microsoft Active Directory Certificate Services (AD CS) for enhanced security and authentication.

How can you make a difference?

The purpose of this assignment is to engage a consultant who will provide on-demand services for the implementation, migration, and operational support of Certificate Services and PKI. Furthermore, the consultant will offer expertise and guidance in the architecture and operation of the CloudWAN SecureAccess Cloud-based global VPN. The objective is to ensure the organization’s remote access infrastructure is secure, efficient, and aligned with industry best practices.

The programme area of this assignment focuses on enhancing ICTD PSD CORE’s remote access infrastructure and security. The specific project area includes the implementation and migration of Certificate Services and PKI, as well as providing operational and architecture support for the CloudWAN SecureAccess Cloud-based global VPN.

Objectives:

• Advisory on maintaining a secure and reliable remote access solution utilizing Microsoft Always On VPN, Microsoft DirectAccess, Absolute Secure Access, ZTNA, SSE, and SASE frameworks.
• Advisory on maintaining a robust and scalable PKI infrastructure using Microsoft AD CS for enhancedsecurity and authentication.
• Advisory on maintaining existing Certificate Services and PKI infrastructure.
• Advisory on provisioning of operational and architecture support for the CloudWAN SecureAccess Cloud-based global VPN.
• Advisory on compliance with industry standards and best practices for remote access security.

Major tasks to be accomplished:

• On-demand, assess the current remote access infrastructure and identify security vulnerabilities andgaps.
• On-demand, contribute to Design and implement the necessary components of Microsoft Always On VPN, Microsoft DirectAccess, Absolute Secure Access, ZTNA, SSE, and SASE frameworks to establish a comprehensive and secure remote access solution.
• On-demand, help plan and execute the migration of Certificate Services to the new PKI infrastructure based on Microsoft AD CS.
• On-demand, provide operational and architecture support for the CloudWAN SecureAccess Cloudbased global VPN, including configuration, troubleshooting, and performance optimization.
• On-demand, collaborate with ICTD Core for knowledge transfer
• On-demand, conduct training sessions and participate in workshops for the organization’s staff to increase awareness and understanding of the implemented solutions and best practices for secure remote access.

Responsibilities of the Consultant:

• Assess the current remote access infrastructure and identify security vulnerabilities and gaps.
• Design and implement Microsoft Always On VPN, Microsoft DirectAccess, Absolute Secure Access,
• ZTNA, SSE, and SASE frameworks.
• Plan and execute the migration of Certificate Services to the new PKI infrastructure.
• Provide operational and architecture support for the CloudWAN SecureAccess Cloud-based global VPN.
• Collaborate with the organization’s IT team for knowledge transfer and transition.
• The consultant will work with his/her own IT resources (i.e. laptop)

Responsibilities of UNICEF:

• Provide access to relevant network infrastructure and systems for assessment and implementation.
• Collaborate with the consultant in defining requirements and priorities.
• Allocate necessary resources and personnel to support the implementation and migration processes.
• Participate in knowledge transfer sessions

Deliverables:

Financial proposal:  Financial Bid template_SecureAccess and PKI.docx

Payment Schedule:

The LTA to be signed will have a fixed fee rate for a maximum of three years. However, UNICEF does

not warrant that any quantity of services will be purchased during the term of the LTA, as this will depend on forthcoming needs.

Estimated duration of the LTA:

This Consultancy is Hybrid with a combination of on-site services in Valencia, Spain and off-site/remote and expected to have a maximum duration of 36 months from the start date. Also, Consultants in this new LTA modality may also be required to participate and facilitate in Workshops.

However, the contract will be delivery based and paid based on deliverables requested explicitly and on demand based on variable needs.

Travel:  

If there is a need to engage in something extremely complex that can not be achieved remotely, travel to Valencia, (Spain) might be involved. 

UNICEF will pay for the travel fare to Valencia (economy travel) and for the official UN DSA valid at the travel period.

To qualify as an advocate for every child you will have… 

Academic Degrees:

• Bachelor’s Degree in Information Systems or Computer Science desirable (not required)

Required Experience:

• A minimum of 4 of relevant professional experience in working with or providing specialized IT Consultancies in Always-On VPN technologies like DirectAccess, Windows Always On VPN, Azure VPN and Azure WAN, Public Key Cryptography, NetMotion, SecureAccess, Microsoft Azure.

Desirable Experience and skills:

• Industry Certifications 

Language Requirements: 

• Fluency in English is required.  

• Knowledge of another official UN language (Arabic, Chinese, French, Russian or Spanish) or a local language is an asset.

For every Child, you demonstrate… 

UNICEF’s values of Care, Respect, Integrity, Trust, Accountability, and Sustainability (CRITAS). 

 To view our competency framework, please visit here. 

Remarks:

The application to be submitted through the online portal should contain four separate attachments:

1. A Cover letter explaining the motivation for applying and explaining how the qualifications and skillset

of the candidate (to be uploaded online)

2. Curriculum Vitae (CV) (to be uploaded online)

3. Three Work Samples – This includes three previously written human-interest stories / reports /

advertising materials / content created / proposal. (to be uploaded online)

4. A financial proposal indicating professional fee as per the above template. Please do not forget to specify your name in the file while saving. (To be uploaded under other supporting documents).

Important Note: Please do not indicate financials anywhere else than in the online application form, and mark “n/or 00” under the fee-related questions in the online application form.

Without all the above 4 documents your application will be considered incomplete and invalid and will not be considered further.

• Any attempt to unduly influence UNICEF’s selection process will lead to automatic disqualification of the applicant.

• Joint applications of two or more individuals are not accepted.

• Please note, UNICEF does not charge any fee during any stage of the process.

• Female candidates meeting the requirements are strongly encouraged to apply.

• UNICEF is committed to diversity and inclusion and encourages qualified candidates from all backgrounds including persons living with disabilities to apply.

Only shortlisted candidates will be contacted and advance to the next stage of the selection process. 

Individuals engaged under a consultancy or individual contract will not be considered “staff members” under the Staff Regulations and Rules of the United Nations and UNICEF’s policies and procedures, and will not be entitled to benefits provided therein (such as leave entitlements and medical insurance coverage). Their conditions of service will be governed by their contract and the General Conditions of Contracts for the Services of Consultants and Individual Contractors. Consultants and individual contractors are responsible for determining their tax liabilities and for the payment of any taxes and/or duties, in accordance with local or other applicable laws. 

The selected candidate is solely responsible to ensure that the visa (applicable) and health insurance required to perform the duties of the contract are valid for the entire period of the contract. Selected candidates are subject to confirmation of fully-vaccinated status against SARS-CoV-2 (Covid-19) with a World Health Organization (WHO)-endorsed vaccine, which must be met prior to taking up the assignment. It does not apply to consultants who will work remotely and are not expected to work on or visit UNICEF premises, programme delivery locations or directly interact with communities UNICEF works with, nor to travel to perform functions for UNICEF for the duration of their consultancy contracts.