Information Security Governance Expert

What you will do

You will work directly with the CISO to prepare and deliver information security governance initiatives across the organisation. This is an autonomous role where you structure work, carry results forward to the general directorates, and support them with your security expertise.

Your activities include:

• Conducting NIS2 maturity assessments and gap analysis across 40 security artefacts
• Designing the risk management framework: strategy, appetite, risk register and treatment plans
• Leading the external attack surface management (EASM) initiative: asset discovery, prioritisation and remediation tracking in collaboration with the IT service provider
• Drafting priority security policies and securing their adoption by the directorates
• Supporting the general directorates in integrating security controls, working with the network centre, data protection and quality teams, the DPO and the IT service provider
• Producing indicators and decision documents for the management committee

What we are looking for

You have at least five years of professional experience in information security governance or security risk management.

Essential experience:

• Participation in NIS2 directive implementation (or Belgian law of 26 April 2024) within an organisation
• Leading at least one maturity assessment or gap analysis against a security framework (ISO 27001, CyFun, NIST CSF) as the person responsible
• Building a security risk register and conducting risk analyses with business stakeholders (ISO 27005 or equivalent method)
• Practical experience with external attack surface management (EASM): discovering exposed assets, prioritisation and tracking remediation

Required skills:

• Business impact analysis (BIA) and business continuity
• Facilitating workshops and consultations with business directorates
• NIS and NIS2 directives (Belgian laws of 7 April 2019 and 26 April 2024): implementation
• Maturity assessment and gap analysis
• ISO/IEC 27001: information security management system (ISMS)
• ISO/IEC 27005: security risk analysis and management
• Writing security policies and procedures
• Security control frameworks: CyberFundamentals (CyFun), ISO/IEC 27002, NIST CSF
• Risk registers, treatment plans and risk appetite

Certification required:

At least one of the following: CISM, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, ISO 27005 Risk Manager.

Language:

Native or near-native French. The mission is conducted exclusively in French.

You have an energetic and autonomous profile. You enjoy structuring work, helping others and driving forward the topics you own.

The setting

This assignment runs from 1 December 2026 to 30 June 2027, part-time at 3/5.

The work is hybrid, combining on-site and remote work. On-site presence in Brussels is required two days per week for a full-time schedule, pro-rated to the part-time arrangement (so approximately one day per week for this 3/5 role).

You must be available to start by 15 December 2026 at the latest.

You can join us for this assignment as a freelancer or as an employee of HumanInTech. Same role, same team. If you join as an employee, your employment continues beyond this assignment. When it ends, we'll work together to find your next assignment.

Location: Brussels, hybrid

Work address: Belgium

Employer / contracting party: HumanInTech

Applications close (Brussels time): November 14, 2026 at 1:00 AM

Engagement: Freelance or employed by HumanInTech

Working hours: Full-time

Experience: 6-10 years or more

Education: Bachelor's or more

Published: November 2026