Junior Legal Counsel

Aurendor is a Belgian company that detects disinformation and foreign information manipulation (FIMI) aimed at critical sectors: defence, public security, financial infrastructure and logistics. We look at what social platforms actually serve to real people, with their informed consent, and turn it into intelligence that defence, security and regulated financial clients can act on.

That puts us where data protection, security and sovereignty meet. Our clients ask hard questions, and so do their lawyers and their security teams. We host our infrastructure in Europe and keep our data under European jurisdiction, and we have to be able to prove it.

We are hiring our first in-house legal counsel. It is a two-part role: you will also take charge of information security governance. You won't join a legal or security department, because you will be building both.

What you will do

On the legal side, you will lead our data protection impact assessments and our GDPR compliance, from collecting consent to retaining data. You will deal directly with the DPOs and legal teams of our institutional clients. You will draft and negotiate our contracts: NDAs, collaboration agreements with public bodies, pilot and licence agreements, and data processing agreements. You will track the rules that shape our business, including the AI Act, the DSA, NIS2 and DORA, and support our European and defence funding bids. You will also look after our intellectual property and the company's legal basics: fundraising documents, the shareholder agreement and the employee equity plan.

On the security side, you will own our security policies and set the course towards ISO 27001 and 27701 certification. You will answer the security questionnaires and third-party risk reviews that clients send us. You will work hand in hand with our engineers on access control, logging, incident response and the choice of suppliers. You set the rules and make sure we can prove we follow them, and the engineers build them in.

Who we are looking for

• A master's degree in law, ideally specialised in technology law, data protection or EU law.
• 1 to 3 years' experience, in a firm, a DPO office, a regulator or a tech company.
• You are truly at ease with technology. You know how a data pipeline, a cloud environment and an access policy work, and engineers take you seriously.
• An interest in information security, ideally backed by a first certification (ISO 27001 Lead Implementer, CIPP/E, or similar) or a willingness to earn one in your first year.
• Some exposure to the public sector, procurement or defence is a strong plus. You must be eligible for Belgian security clearance.
• Fluent English and French; Dutch is a real asset.
• A start-up mindset with an eye on scale-up: you build processes that will still hold when we are ten times bigger, without slowing us down today.
• You believe European digital sovereignty is a legal and strategic issue, not a slogan.

What we won't hide from you

We are a start-up. You won't have a senior lawyer or a CISO above you day to day, priorities will shift, and some of the people across the table will have twenty years' experience. We keep an external law firm for the heaviest legal matters. In return, you will build a legal and security function from scratch in a company that works with defence and critical infrastructure. Few junior roles anywhere offer that.

The practicalities

Permanent, full-time contract at BeCentral (Brussels Central).