Cybersecurity GRC Consultant

Job Title: Expert in Information Security Governance (NIS2, CyFun, EASM)

Language: French

Location: 1080 Molenbeek-Saint-Jean, Belgium

Duration: 01/12/2026 - 30/06/2027

Part Time: 3/5

Hybrid: 2 days on-site per week

Job Description:

• The Ministry of the Wallonia-Brussels Federation (MFWB), an entity subject to NIS2, is building its information security function and embarking on a CyberFundamentals (CyFun) trajectory, supported by a 2026-2029 strategy approved by the Government.
• Alongside the CISO, to whom you report directly, you prepare the work independently, then you bring the results to the General Administrations and support them with your security expertise. You have an energetic and autonomous profile, who likes to structure, help and advance the subjects you are responsible for.
• Hybrid working mode combining face-to-face and teleworking, 3 days a week. On-site presence (MFWB offices, Brussels): 2 days a week for a full-time employee, in proportion to the regime worked.
• The mission is in French only.

Activities

• Conduct the NIS2 maturity assessment and gap diagnosis on the Department's 40 security artifacts;
• Design the risk management system: strategy, appetite, register and treatment plans;
• Lead the external attack surface management (EASM) project: discovery, prioritization and treatment of exposures with Client;
• Draft priority security policies and have them adopted by management;
• Support the General Administrations in the integration of security controls, in conjunction with the CEN, the DQPS, the DPO and the Client;
• Produce indicators and decision files for the Executive Committee.

Skills:

• Business Impact Analysis (BIA) and Business Continuity
• Facilitation of workshops and consultations with business departments:
• NIS and NIS2 Directives (Belgian Laws of 7 April 2019 and 26 April 2024): Implementation
• Maturity assessment and gap assessment
• External attack surface (EASM) and exposure management: asset discovery, prioritization, processing tracking
• ISO/IEC 27001: Information Security Management System (ISMS)
• ISO/IEC 27005: Security risk analysis and management
• Drafting of security policies and procedures
• Security control frameworks: CyberFundamentals (CyFun), ISO/IEC 27002, NIST CSF
• Risk register, treatment plans and risk appetite

Languages

• French: Level Native

Questions

• Do you have at least 5 years of professional experience in information security governance or security risk management?
• Have you been involved in the implementation of the NIS2 Directive (or the Belgian law of 26 April 2024) within an organisation? If so, please describe it in your CV.
• As a manager, have you conducted at least one maturity assessment or a gap diagnosis with regard to a security standard (ISO 27001, CyFun, NIST CSF)?
• Have you built a security risk register and conducted risk analyses with business managers (ISO 27005 or equivalent)?
• Do you have at least one certification from: CISM, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, ISO 27005 Risk Manager? If so, please attach it to your application.
• Do you confirm that you can ensure an on-site presence in the MFWB offices in Brussels for 2 days a week for a full-time employee, in proportion to the regime provided?
• Do you have hands-on experience with external attack surface management (EASM): discovering exposed assets, prioritizing, and tracking their processing?
• Are you available to start the mission no later than December 15, 2026?