Chief Information Security Officer

Chief Information Security Officer (External CISO)

Freelance Assignment

Positioning: Second Line of Defense

Collaboration: Executive Management, Business, IT, Enterprise Risk Management, DPO, and Internal and External Audit

1. About the Assignment

Our client is an established professional services organization operating in a regulated environment, where information security, risk management, compliance, and customer trust are essential to business continuity and sustainable growth.

The organisation is looking for an experienced freelance Chief Information Security Officer (CISO) to strengthen its cybersecurity strategy, governance, and cyber risk management.

Embedded within Corporate Legal, Risk & Compliance, the External CISO will provide independent oversight and challenge from the Second Line of Defense, while working closely with Business and IT to ensure that cybersecurity principles are translated into practical solutions.

This is a strategic and hands-on assignment. The CISO will establish the cybersecurity framework, guide the organisation's security priorities, support the implementation of key initiatives, and report independently on risks and programme effectiveness. The role focuses on strategy, governance, risk management, and compliance rather than day-to-day technical operations.

A key priority during the first 6 to 12 months will be the development and implementation of the strategic Security by Design programme, ensuring that security is integrated into projects, processes, systems, supplier selection, and digital initiatives from the outset.

The CISO is expected to provide direction, build stakeholder support, and influence decisions through expertise and credibility rather than formal authority.

2. Key Responsibilities

A. Cybersecurity Strategy and Governance

• Develop, maintain, and operationalise the cybersecurity strategy and multi-year roadmap.
• Establish and maintain the Information Security Management System (ISMS), cybersecurity governance framework, and Target Operating Model.
• Translate the organisation's risk profile into priorities, milestones, investment requirements, and clear responsibilities.
• Develop practical security policies, standards, and guidelines.
• Coordinate the cybersecurity programme, monitor its progress and effectiveness, and ensure alignment between initiatives.
• Promote shared accountability for cybersecurity across Business and IT, including through a network of security champions.

B. Security by Design and Business Partnership

• Lead the development and implementation of the Security by Design programme.
• Ensure security is incorporated into projects, processes, systems, supplier decisions, and organisational change initiatives from the outset.
• Work hands‑on with Business and IT teams to translate security policies and principles into concrete solutions, analyses, and deliverables.
• Advise on strategic initiatives involving digitalisation, cloud, data, AI, OT/IoT, and new services.
• Help stakeholders balance security requirements with business objectives, operational continuity, and innovation.
• Integrate cyber risks into the broader Enterprise Risk Management framework.
• Maintain the cyber risk register, including risk owners, treatment plans, and residual risks.
• Conduct or coordinate risk assessments for projects, systems, suppliers, and significant organisational changes.
• Define proportionate control measures and explain the operational, commercial, and organisational impact of technical risks.
• Advise on risk treatment and monitor agreed actions, ensuring that risk ownership, risk acceptance, and implementation remain with the appropriate Business and IT stakeholders.

D. Compliance, Assurance, and Security Assessments

• Support compliance with ISO 27001, NIS2, GDPR, and relevant sector-specific obligations, in coordination with the Data Protection Officer (DPO).
• Coordinate or support audits, maturity assessments, gap assessments, and risk‑based control assessments.
• Review and challenge penetration tests, technical security assessments, and risk analyses.
• Monitor audit findings and improvement actions through to completion.

E. Reporting and Executive Advisory

• Develop relevant cybersecurity Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs).
• Report periodically on the cybersecurity risk profile, residual risks, maturity, programme progress, investment needs, and required decisions.
• Prepare reports for executive management, the Audit Committee, and the Board of Directors.
• Translate complex technical risks into clear business implications and demonstrate how security inv