Expert in Information Security Governance (NIS2, CyFun, EASM)

Project overview

Our client is an entity subject to NIS2 and is building its information security function and embarking on a CyberFundamentals (CyFun) trajectory.

Activities:

Languages: French: Native

Questions:

• Lead the NIS2 maturity assessment and gap analysis on the 40 security artifacts
• Design the risk management framework: strategy-appetite-register-treatment plans
• Manage the external attack surface management (EASM) project
• Draft priority security policies and get them adopted by management
• Support General Administrations in integrating security controls
• Produce indicators and decision documents for the Management Committee.
• Risk Management: Expert
• Business Impact Analysis (BIA) and Business Continuity Level: Confirmed
• Facilitate workshops and consultations with business departments: Confirmed
• NIS and NIS2 Directives (Belgian laws 2019 and 2024): Confirmed
• Maturity Assessment and Gap Analysis: Confirmed
• External Attack Surface Management (EASM) and Exposure Management: Confirmed
• ISO/IEC 27001: Information Security Management System (ISMS): Confirmed
• ISO/IEC 27005: Security Risk Analysis and Management: Confirmed
• Drafting security policies and procedures: Confirmed
• Security Control Frameworks: CyFun, ISO/IEC 27002, NIST CSF: Confirmed
• Risk Register, Treatment Plans, and Risk Appetite: Confirmed
• Do you have at least 5 years of professional experience in information security governance or security risk management?
• Have you participated in the implementation of the NIS2 directive (or the Belgian law of April 26, 2024) within an organization? If so, please describe it in your CV.
• Have you led, as a manager, at least one maturity assessment or gap analysis against a security framework (ISO 27001, CyFun, NIST CSF)?
• Have you built a security risk register and conducted risk analyses with business managers (ISO 27005 or equivalent method)?
• Do you hold at least one certification among: CISM, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, ISO 27005 Risk Manager? If so, please attach it to your application.
• Do you confirm that you can ensure a presence on-site in Brussels of 2 days per week for a full-time position, pro-rata to the hours worked?
• Do you have practical experience in External Attack Surface Management (EASM): discovery of exposed assets, prioritization, and monitoring of their remediation?
• Are you available to start the assignment no later than December 15, 2026?

Project details

• Start: flexible
• Remote: hybrid
• Location: Brussels, Belgium, BE
• Languages: French