Home  /  Meet our people  /  Meet Sarah Brown, Cyber Security Lead at the NCI Agency

Jan 25 2023

Meet Sarah Brown, Cyber Security Lead at the NCI Agency


Sarah Brown has been a NATO Civilian Staff member since 2016, when she joined the Capability Development Branch of the NATO Cyber Security Centre (NCSC). However, she has been working with NATO since 2008. She first arrived in the Netherlands, working as a US voluntary contribution and technical liaison at NC3A, one of the NCI Agency's predecessors. Her work over her career has focused on cyber adaptation, technical cyber defence, information sharing, coalition operations, cyber exercises, and technical security standards.


Since joining the NCI Agency, Brown has also helped lay the groundwork for NATO's Cloud Security Technical Directive, and contributed to the development of the Cyber Information and Incident Coordination System (CIICS), to be used during NATO's operational exercise Steadfast Cobalt 2019.

Meet Sarah Brown, Cyber Security Lead at the NCI Agency

More recently, during the Agency's flagship conference, NATO Edge 2022, Brown led an engaging fireside discussion with Kersti Kaljulaid, former of the Republic of Estonia, on the role of technology in the future of the Alliance.

From 2020 to 2021, Brown was one of two NCI Agency representatives that supported the NATO Enterprise Cyber Adaptation Project led by the Deputy Secretary General. Upon her return to the NCI Agency, she led the team that developed the Agency's first Cyber Security Strategy. In October 2022, Brown was awarded NATO's most prestigious honour, the Meritorious Service Medal, in recognition of this work, her significant contributions to the Alliance, and her commitment to ensuring NATO's cyber resilience.

What are some of the skills you have acquired from working in such a complex security environment?

Being in the Agency has allowed me to grow, by further developing and combining my technical background, resourcefulness, creativity, and solution-oriented approach to purpose. It has also allowed me to pursue initiatives that directly support the Agency's technical and business goals. I was fortunate enough to work on the Cyber Adaptation project with people from all over NATO and experts from the field, who brought their own unique understanding of cyber security across the Enterprise. I was able to soak up all the knowledge gathered in this project and broaden my own perspective in many ways.

As the lead of the NCI Agency's first ever Cyber Security Strategy, what were the main challenges in carrying forward such a large and complex task?

Developing the Cyber Security Strategy was a wonderful opportunity to capture cyber adaptation learnings, Agency strategic goals in cyber security, and redefine ways of working between functional and business area teams. Our main challenge was completing this in an aggressive timeline. To do so, we leveraged an open-source framework for developing an IT security strategy, and divided the work across a set of dedicated working sessions. In the end, the Agency's leadership and Supervisory Board were supportive of the methodology and outcome of the work, and it was formally completed as initially planned, by July 2021.

Throughout the process of working on the Cyber Security Strategy, what I remember most was the momentum and participation from people across the Agency. Our challenge now is to demonstrate the ways in which we are working towards the Agency's strategic goals. Again, this is a great opportunity to showcase what we are doing and the direct links to our cyber security objectives, which are derived from the NATO Atlantic Council's endorsed Cyber Adaptation priorities.

How is the Agency adapting to the rising cyber security challenges NATO is facing?

Ultimately, cyber security is about protecting our environment and managing risk from the inevitable threats we face. The Cyber Adaptation Strategy allowed NATO to review its current maturity across cyber security functional areas and understand how these various areas support the overall goal of a cyber-resilient environment, which enables NATO to conduct its core tasks. The Agency, working with the rest of the Alliance, is supporting key efforts that will raise our current level of maturity and resiliency. Beyond technical contributions, the Agency is also supporting concept development in the area of defensive cyberspace operations, as well as providing approaches to procurement that can more efficiently bring new technology solutions into the NATO environment.

What do you enjoy most about working at the Agency?

I get a lot of enjoyment out of working with teams from across the Agency and with our customers, because it allows me to understand different people, perspectives, and the operational context that we are in. I am surrounded by exceptional colleagues in many areas and high-performing teams who consistently push to achieve more than we have before. Though I have a long list of high-priority, high-visibility activities, I am also greatly energized by what we are accomplishing together.