Implementation Specialist ISO 27001/27002

Project overview

Assignment

The Data, Technology and Innovation department is looking for 1 implementation specialist to temporarily strengthen the team. Together with your direct colleagues Security Officers and under the functional direction of the CISO, you will play an active role in information security within the AFM. You will support the departments within the AFM in setting up and implementing information security policy and NIS2/BIO2.0 measures. You will participate in the workstreams for BIO2 compliance. Among other things, you will draw up various GAP analyses between the PDC and its implementation.

You will also identify deviations or shortcomings and ensure they are placed on the agenda. Where necessary, you will support the internal team with operational issues and contribute to the improvement of the business continuity program. You will work closely with other colleagues and (IT) suppliers, including IT service providers, operational risk officers, privacy officers, and the internal audit service.

Responsibilities

o Prepare mandatory documentation set;

o Risk assessment and risk treatment;

o Further elaborate information security policy;

o Gap analysis of current measures; and

o Develop PDCA cycle.

• Provide support in further structuring the ISMS at the AFM:
• Provide support in maintaining and further developing Business Continuity Management (BCM) in accordance with NIS2/BIO2.0 requirements.
• Further develop supplier management in accordance with NIS2/BIO2.0 requirements.
• Develop and implement the required control measures from BIO2.0.
• Support the current security organization with operational issues/problems.

Requirements

You have at least a relevant HBO (higher professional education) degree with a strong ICT or security component. You have additional training and certification as RE/CISA, CISM, CISSP or CIPP/E and demonstrably maintain your knowledge level. You have at least 5 years of relevant work experience in a similar role in the field of information security.

Wishes

You have knowledge of relevant laws and regulations, such as NIS2 and AVG (GDPR), and can verify compliance. For example, through demonstrable experience with internal audits or (re)certification processes. You have demonstrable experience in setting up and further developing an ISMS according to ISO 27001:2022 and BIO2.0 in a (semi-)public or regulated environment. You have demonstrable experience with developing and implementing business continuity programs (including BIA and BCP) and can link this to the requirements that BIO2.0 imposes on them.

You have demonstrable experience with developing and implementing supplier management and third-party risk management (TPRM) according to BIO2.0, including ensuring security requirements in contracts and tenders. You have experience with IT governance regimes and with managing IT service providers in ensuring BIO2.0 requirements in outsourced services. You have demonstrable experience with drafting and implementing policy in the context of a government organization and can write administrative documents, such as memos, reports, and management reviews.

You have basic knowledge of privacy legislation (AVG), responsible use of AI (such as Copilot), and information and data security, as far as it is relevant to the role.

Employment conditions

This is an assignment with an intended start date as soon as possible, with a duration of 12 months. The assignment is for 32 hours per week. There is an option for extension for a maximum of 6 months. Please note: you may be asked not to work hours in the last 2 weeks of the year. The freelancer must provide their own laptop, phone, and other office supplies.

Additional information

When you offer a professional to us as a supplier and they are placed, we will need information from you as a contracting party, including regarding the Chain Liability Act (Wet keten- en inlenersaansprakelijkheid). The 'WKA' aims to prevent abuse in the remittance of payroll taxes at all links in the chain; from supplier to client. We cover these risks for our clients through a blocked account, the G-account. This is an account to which a portion of the invoice amount is deposited and from which you can pay payroll taxes and VAT to the Tax Authorities.

The percentage to be deposited depends on whether you have a SNA certification (NEN-4400-1 or NEN-4400-2) and whether your company is established in the Netherlands or abroad. You can apply for the G-account from the Tax Authorities. If you cannot obtain a G-account (and you can provide proof of this from the Tax Authorities), you also have the option to submit an accountant's statement (assurance report regarding personnel lending) every quarter. In this, a certified accountant (AA or RA) will issue a statement about the accuracy, completeness, and timeliness of the remittances.

Please note that the costs for this statement are at your own expense.

Project details

• Start: 2026-10-25T23:00:00
• Location: Amsterdam Noord-Holland, NL
• Languages: Dutch