Information Technology Security Specialist

Context

A Belgian public administration, an entity subject to NIS2, is building its information security function. It is following a CyberFundamentals (CyFun) roadmap as part of a multi-year strategy approved at the highest level.

The consultant reports directly to the CISO. The work is prepared independently, then presented to the various directorates-general, which the consultant supports with security expertise.

Responsibilities

• Conduct the NIS2 maturity assessment and gap analysis across all of the organisation’s security artefacts.
• Design the risk management framework: strategy, risk appetite, risk register and treatment plans.
• Lead the external attack surface management (EASM) workstream: discovery, prioritisation and remediation of exposures, together with the IT operator.
• Draft priority security policies and secure their adoption by management.
• Support the directorates-general in embedding security controls, in coordination with the quality departments, the DPO and the IT operator.
• Produce KPIs and decision files for the executive committee.

Profile

Education and experience

• At least 5 years of experience in information security governance or security risk management.
• Involvement in implementing NIS2 (or the Belgian law of 26/04/2024) within an organisation.
• At least one maturity assessment or gap analysis led as the responsible person (ISO 27001, CyFun or NIST CSF).
• Experience building a security risk register and running risk analyses with business owners (ISO 27005 or equivalent method).
• Hands-on EASM experience: discovery of exposed assets, prioritisation, remediation follow-up.
• Certification is an asset: CISM, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, ISO 27005 Risk Manager.

Technical skills (confirmed level)

• NIS and NIS2 directives and their Belgian transposition (laws of 07/04/2019 and 26/04/2024).
• ISO/IEC 27001 (ISMS) and ISO/IEC 27005 (security risk analysis and management).
• Control frameworks: CyberFundamentals (CyFun), ISO/IEC 27002, NIST CSF.
• Maturity assessment and gap assessment.
• Risk register, treatment plans and risk appetite.
• Business impact analysis (BIA) and business continuity.
• Writing security policies and procedures.

Soft skills

• Autonomy and drive in moving topics forward.
• Enjoys structuring work and supporting teams.
• Comfortable facilitating workshops and consultations with business directorates.

Languages

• French: native level. The assignment is conducted exclusively in French.

Location and conditions

• Type: consultancy assignment.
• Location: Brussels.
• Hybrid: 2 days per week on site for a full-time schedule (pro rata for part time), 3 days remote.
• Start date: 15/12/2026 at the latest.