Chief Information Security Officer

Purpose of the assignment:

• Giving direction to the cybersecurity strategy and the multi-year cybersecurity program.

• Integrate cyber risk into Enterprise Risk Management and strategic decision-making.

• Develop and maintain an effective Information Security Management System and governance framework.

• Demonstrably strengthen the cyber resilience and cybersecurity maturity of the organization.

• Sustainably embedding Security by Design in processes, projects, systems and digital initiatives.

• Translating complex risks into clear decision-making information for the board, management and administrative bodies.

• Enabling safe growth, innovation and digital transformation through proportionate and workable measures.

• Setting up, directing and monitoring the cybersecurity programme and reporting independently on its effectiveness to management and administrative bodies.

• Actively use security as a lever for customer confidence, operational continuity and competitive advantage.

Responsibilities:

Strategy, governance and operationalisation

• Developing, updating and operationalizing the cybersecurity strategy and the multi-year program.

• Develop and maintain the ISMS, the cybersecurity governance framework and a workable Target Operating Model.

• Translating the risk profile into priorities, milestones, investment needs and clear responsibilities.

• Drafting and maintaining practical, readable and applicable security policies, standards and guidelines.

• Building support and stimulating shared ownership, including through a network of security champions.

• To manage the cybersecurity programme integrally and to monitor its coherence, implementation and effectiveness, without taking over the operational implementation by the first line.

• Explicitly assign security responsibilities to the right business and IT owners and ensure that they include risks and control measures within their mandate.
 

Security by Design en business partnership

• Leading and coordinating the further elaboration and implementation of Security by Design.

• Ensure that security is integrated into projects, processes, systems, supplier choices and change processes from the start.

• Translating general policy principles into concrete solutions and, where necessary, actively developing examples, analyses and deliverables.

• Acting as a strategic partner for initiatives around digitalization, cloud, data, AI, OT/IoT and new services.

• Helping management to make risk-based decisions, balancing safety, continuity and entrepreneurship.
 

Cyber risk management

• Integrating cyber risk into the broader Enterprise Risk Management framework.

• Developing and maintaining the cyber risk register, including risk owners, treatment plans and residual risks.

• Performing or supervising risk analyses for projects, systems, suppliers and important organizational changes.

• Formulating proportionate control measures and translating technical risks into operational, commercial and organizational impact.

• Clearly monitor that ownership of cyber risks, risk acceptance and implementation of control measures remains with the competent business and IT managers; the CISO establishes the framework, advises, monitors and challenges from the second line.
 

 Compliance, assurance in control

• Supporting compliance with ISO 27001, GDPR and relevant sectoral obligations, in alignment with the DPO.

• Supervising audits, maturity assessments, gap assessments and improvement processes.

• Performing or coordinating risk-based control assessments and follow-up of improvement measures.

• Assessing and challenging penetration tests, risk analyses and technical security assessments.
 

 Reporting and decision-making

• Developing relevant KPIs and KRIs for cybersecurity.

• Periodically reporting on risk profile, residual risks, maturity, program progress, investment needs and necessary decisions.

• Preparing reports for the board, management, Audit Committee and Board of Directors.

• Provide insight into how security investments contribute to risk reduction, business continuity, compliance and customer trust.
 

 Incidents and cyber resilience

• From the second-line role, follow-up of material security incidents, root-cause analyses, lessons learned and structural improvement actions.

• Advising on preparedness, detection, response and recovery and ensuring that responsibilities are clearly assigned.
 

Supplier and third-party risks

• Support the Third-Party Risk Management framework and the periodic security assessment of critical suppliers.

• Advising on security requirements in vendor selection, contracting, outsourcing and cloud solutions.
 

Awareness and safety culture

• Develop and support an organization-wide security awareness program, with training, phishing simulations, onboarding modules and management sessions.

• Stimulate safe behavior and shared ownership and position cybersecurity as a facilitator of safe growth and innovation.

• Incorporate visible leadership into the organization and build coalitions that translate security into concrete behavior, decision-making and ownership.
 

 Advice on strategic initiatives

• Acting as a strategic partner for business, operations and IT teams on new initiatives and change processes.

• Actively contribute to initiatives around digitization, cloud transformation, AI, data, OT/IoT and new services, so that innovation can be realized safely and in a controlled manner.

• Actively identify how security can strengthen customer trust, continuity and the commercial positioning of Partena Professional.
 

Experience and expertise

• At least ten years of relevant experience in cybersecurity, information security, cyber risk management or cybersecurity governance.

• Proven experience as a CISO, vCISO or senior cybersecurity advisor and with multi-year transformation programs.

• In-depth knowledge of ISO 27001, NIS2, GDPR, cyber risk management and cybersecurity governance.

• Sufficient technical expertise to assess the content of risk analyses, penetration tests and security assessments.

• Broad knowledge of IAM, data protection, DevSecOps, detection and response and Third-Party Risk Management.

• Experience with reporting to management, Audit Committee or Board of Directors and with audits and maturity assessments.

• Experience with digitization, cloud, data or AI initiatives is an important added value.

Professional competencies and working style

• Strategically strong and at the same time outspoken hands-on, pragmatic and result-oriented.

• Able to create support based on trust, cooperation and business relevance.

• Strong in translating complex technical risks into understandable administrative language and concrete business impact.

• Independent in advice and challenge, with respect for the responsibilities of business and IT.

• Willing to work out analyses, examples and other deliverables in addition to advice.

• Strong in stakeholder management, coalition building and guiding sustainable culture change.

• Persuades without coercion and can give direction based on expertise, credibility and a clear mandate.

• Acts as a translator between management, business and technology and makes responsibilities, choices and consequences explicit.

• Is a coalition builder who converts shared interests into supported agreements and implementation.

• Is persistent and monitors agreed risk treatment and improvement actions until ownership and results are demonstrable.