Hiring of Cybersecurity Consultant for NEPRA

The National Electric Power Regulatory Authority (NEPRA) in Islamabad Capital Territory is procuring consultancy services for hiring a Cybersecurity Consultant to support its regulatory oversight and internal cybersecurity posture enhancement. This consultancy is planned for the financial year 2026-27 and aims to strengthen cybersecurity governance across Pakistan's power sector licensees. Items being procured: - Evaluation of cybersecurity compliance submissions from licensees - Implementation of security operations technology including gap assessment, monitoring, threat hunting, intelligence, vulnerability management, and automation - Ensuring IT and OT systems architecture compliance with industry standards such as Zero-Trust Architecture - Design and implementation of secure by design principles in information systems - Preparation of consolidated quarterly compliance assessment reports - Review of cybersecurity audit reports submitted by licensees - Comprehensive review and amendment proposals for NEPRA's IT/OT Security Regulations - Development and implementation of standardized cybersecurity compliance data submission and evaluation processes - Tailored capacity-building training plan for OT cybersecurity for technical professionals - Technical advisory services on emerging threats and regulatory enforcement - Support for NEPRA's internal cybersecurity infrastructure and policies - Design of cybersecurity frameworks for data quality, privacy, and security - Review and prioritization of Critical Information Infrastructure (CII) identification reports - Advisory functions equivalent to Chief Information Security Officer (CISO) without employment status - Any other tasks assigned by NEPRA The scope includes detailed technical and procedural reviews, regulatory compliance assessments, advisory services, and capacity building. The consultant must have at least a BS/BE in Computer Science, Electrical, Information Security, or Cyber Security with 10 years post-degree experience including 3-4 years in securing industrial control systems or OT environments. Professional certifications such as GICSP, GIAC, or ISA/IEC 62443 are mandatory. Experience in the power/energy sector and regulatory environment is preferred. The contract duration is two years with possible extension based on performance. Proposals must be submitted electronically via EPADS v2.0 by **July 30, 2026, 02:00 PM**. Manual submissions are not accepted. The technical bid will be evaluated on qualifications, experience, certifications, and presentation, with a minimum 60% technical score required to qualify for financial bid opening. The procurement method is Quality and Cost Based Selection (QCBS). Bidders should ensure compliance with all eligibility criteria including NADRA citizenship verification and submit all required documents as per the RFP. The submission address for bid security is NEPRA HQ, Attaturk Avenue, Sector G-5/1, Islamabad. The consultant will report to the Director (IT) and must be physically present at NEPRA headquarters during official hours. A practical tip for bidders: Register early on EPADS v2.0 and carefully prepare your technical proposal to meet all mandatory requirements and scoring criteria. Ensure all certifications and experience documents are verifiable and clearly presented to maximize technical evaluation marks. Late or incomplete submissions will be disqualified. This tender offers a significant opportunity for cybersecurity experts to contribute to national power sector security and regulatory compliance enhancement under a prestigious federal authority.