Information Security Governance Expert

h3What you will do /h3 pYou will work directly with the CISO to prepare and deliver information security governance initiatives across the organisation. This is an autonomous role where you structure work, carry results forward to the general directorates, and support them with your security expertise. /p pYour activities include: /p ul liConducting NIS2 maturity assessments and gap analysis across 40 security artefacts /li liDesigning the risk management framework: strategy, appetite, risk register and treatment plans /li liLeading the external attack surface management (EASM) initiative: asset discovery, prioritisation and remediation tracking in collaboration with the IT service provider /li liDrafting priority security policies and securing their adoption by the directorates /li liSupporting the general directorates in integrating security controls, working with the network centre, data protection and quality teams, the DPO and the IT service provider /li liProducing indicators and decision documents for the management committee /li /ul h3What we are looking for /h3 pYou have at least five years of professional experience in information security governance or security risk management. /p pbEssential

experience:
/b /p ul liParticipation in NIS2 directive implementation (or Belgian law of 26 April 2024) within an organisation /li liLeading at least one maturity assessment or gap analysis against a security framework (ISO 27001, CyFun, NIST CSF) as the person responsible /li liBuilding a security risk register and conducting risk analyses with business stakeholders (ISO 27005 or equivalent method) /li liPractical experience with external attack surface management (EASM): discovering exposed assets, prioritisation and tracking remediation /li /ul pbRequired

skills:
/b /p ul liBusiness impact analysis (BIA) and business continuity /li liFacilitating workshops and consultations with business directorates /li liNIS and NIS2 directives (Belgian laws of 7 April 2019 and 26 April 2024): implementation /li liMaturity assessment and gap analysis /li liISO/IEC 27001: information security management system (ISMS) /li liISO/IEC 27005: security risk analysis and management /li liWriting security policies and procedures /li liSecurity control frameworks: CyberFundamentals (CyFun), ISO/IEC 27002, NIST CSF /li liRisk registers, treatment plans and risk appetite /li /ul pbCertification required: /b /p pAt least one of the following: CISM, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, ISO 27005 Risk Manager. /p pbLanguage: /b /p pNative or near-native French. The mission is conducted exclusively in French. /p pYou have an energetic and autonomous profile. You enjoy structuring work, helping others and driving forward the topics you own. /p h3The setting /h3 pThis assignment runs from 1 December 2026 to 30 June 2027, part-time at 3/5. /p pThe work is hybrid, combining on-site and remote work. On-site presence in Brussels is required two days per week for a full-time schedule, pro-rated to the part-time arrangement (so approximately one day per week for this 3/5 role). /p pYou must be available to start by 15 December 2026 at the latest. /p pYou can join us for this assignment as a freelancer or as an employee of HumanInTech. Same role, same team. If you join as an employee, your employment continues beyond this assignment. When it ends, we'll work together to find your next assignment. /p pbLocation: /b Brussels, hybrid /p pbWork address: /b Belgium /p pbEmployer / contracting party: /b HumanInTech /p pbApplications close (Brussels time): /b November 14, 2026 at 1:00 AM /p pbEngagement: /b Freelance or employed by HumanInTech /p pbWorking hours: /b Full-time /p pbExperience: /b 6-10 years or more /p pbEducation: /b Bachelor's or more /p pbPublished: /b November 2026 /p