EPSO/AD/430/26 — Cybersecurity (AD 8)
The EU institutions are recruiting 254 cybersecurity administrators at grade AD 8. Applications close on 13 October 2026 at 12:00 Brussels time. The only test that ranks candidates is a 30-question multiple-choice test on the field, sat in your second language. This page explains what that test measures and how to prepare for it.
The competition at a glance
What the field test measures
The notice publishes no syllabus. The test is "specific to the field", and the field is defined by the typical duties in Annex II. Five categories share the 254 posts, and a good question bank has to cover all five:
- Risk management and security assurance: risk-management frameworks, maturity models, security assessments, vulnerability management, penetration testing, identity and access reviews, metrics and reporting.
- Architecture, design and technology: security architecture for cloud and hybrid systems; SIEM, XDR and CDR tooling; AAA/IAM and PIM/PAM; secure coding and code review; cryptography, key management and the post-quantum transition; DevSecOps; AI, machine learning and quantum computing applied to security.
- Security operations and incident response: monitoring, detection and threat hunting; digital forensics and incident response; SOC engineering, threat-intelligence automation and red teaming; CSIRC services.
- Governance, policy and coordination: security projects and programmes, team leadership, a multiannual security strategy, policies and standards, compliance and audit, interinstitutional working groups.
- Awareness, skills and advisory: awareness campaigns and training, specialist advice on identity and access management, electronic signature and trust services.
How EU-now prepares you for it
EU-now has a dedicated Cybersecurity field inside its ICT specialty. Every question is generated from official sources only, so a question about incident reporting quotes the regulation, not a vendor page: Regulation 2023/2841 on cybersecurity at the EU institutions and CERT-EU, NIS2 and its implementing regulation with the ENISA technical guidance, the Cyber Resilience Act, the Cyber Solidarity Act and the 2025 Cyber Blueprint, the Cybersecurity Act and the EUCC scheme, DORA, the EU post-quantum roadmap, the ENISA Threat Landscape 2025 and the European Cybersecurity Skills Framework, and the NIST publications the duties point at: the Risk Management Framework, SP 800-30 and 800-53, CSF 2.0, Zero Trust (800-207), digital identity (800-63-4), incident handling (800-61r3), forensics (800-86), log management, secure development (SSDF) and the post-quantum standards FIPS 203, 204 and 205.
You pick the field once, at onboarding, and the drills open on it. Each question comes with an explanation that shows why the right option is right and where each distractor goes wrong. The three reasoning tests and the written test are trained in the same place, in the five languages of the platform.
The other tests are pass or fail
Verbal reasoning needs 10 out of 20; numerical and abstract reasoning are scored together and need 10 out of 20 combined. The written test needs 5 out of 10 and is only marked for candidates near the top of the field-test ranking. None of these scores adds to the ranking, so the strategy is simple: clear them safely and put the remaining weeks into the field.
Frequently asked questions
Can I apply for both Cybersecurity and Artificial intelligence?
No. The notice allows one field per candidate, chosen when you submit the application. The choice cannot be changed after the deadline.
Which language is the field test in?
In your language 2, the one you declare at B2 level or above. The reasoning tests are in your language 1 (C1 or above).
Is the test about EU law or about technical security?
Both. The duties in Annex II mix regulation (NIS2, the Cyber Resilience Act, the regime for the EU institutions) with hands-on architecture, operations and incident response. A candidate who knows only one side leaves half of the 30 questions to chance.
Do certifications like CISSP or CISM count?
They are not an eligibility condition and the notice does not mention them. Their bodies of knowledge overlap heavily with the duties, so they are good preparation, but the questions are set on the EU framework and the reference standards, not on any certification syllabus.
Do I need a cybersecurity degree?
Not necessarily. Degrees in cybersecurity, information security, security engineering, forensics or cryptography qualify directly. Most other ICT, engineering, mathematics or data-science degrees qualify with a documented security focus (a formal specialisation, at least 30 ECTS, a thesis, a peer-reviewed paper or a research project during the studies). Without a qualifying degree you need nine years of relevant experience.
Five weeks is enough if you spend them on the right test
Choose the Cybersecurity field at onboarding and start with the drills built from NIS2, the Cyber Resilience Act and the NIST standards.
Start preparing for the Cybersecurity field →The other field of the same notice: EPSO/AD/430/26 — Artificial intelligence (AD 8)
Figures and dates from the Notice of Competition EPSO/AD/430/26, OJ C/2026/4668 of 8 September 2026. Places of employment from the eu-careers listing. eur-lex.europa.eu ↗