Security Consultant

Dates: —

Arrangements: 100% full-time; daytime work; homeworking possible; estimated 800 hours per person. On-site frequency not specified.

The Flemish Tax Administration is seeking one Senior Security Consultant for its Ellipsgebouw location. The assignment focuses on information security risk analysis, policies, processes and governance. The preferred assignment period runs from 1 December 2026 to 31 May 2027. The work regime is 100%, with an estimated 800 hours per person and homeworking possible.

The consultant will conduct risk analyses and draft information security guidelines. The role also involves developing information security processes and monitoring and reporting on compliance. Supporting security architects with legal provisions and risk analyses is another explicit responsibility. ISO27005 risk analysis experience, knowledge of security controls frameworks and NIS2 knowledge are mandatory.

Applicants must demonstrate at least five years of senior security consultancy experience in a relevant environment and Dutch proficiency at CEFR C2. Experience with security management frameworks, expertise-related certifications, FAIR and MITRE ATT&CK are preferred. Candidate evaluation weighs quality and price equally. The engagement is managed through Public-Sourcing under the Flemish government Framework Agreement , Lot 1.

Top Reasons to Apply

Shape security governance

Apply ISO27005 expertise

Support security architects

Address NIS2 compliance

Homeworking possible

Responsibilities

Draft information security guidelines

Develop information security processes

Monitor and report information security compliance

Support security architects on legal provisions and risk analyses

Must Have

Security consultancy experience

Policy and process drafting

ISO2705 risk analysis experience

Security process governance experience

Information security domain expertise

Security controls framework knowledge

NIS2 knowledge

Dutch CEFR C2 proficiency

Nice to Have

Security management framework experience

Domain relevant security certifications

FAIR method knowledge

MITRE ATT&CK framework knowledge

Detailed Responsibilities and Skills

• At least 5 years of demonstrable senior Security Consultant experience in at least one environment such as data, infrastructure or applications.
• Demonstrable experience drafting policy documents and processes.
• Demonstrable experience analysing, optimising and documenting security processes and governance.
• Dutch-language proficiency at European CEFR level C2.

Technical skills

• Demonstrable experience conducting risk analyses according to ISO27005.
• Demonstrable expertise in a specific information security domain. Examples in the description: implementing information security management processes; vulnerability analyses and penetration tests; cost-effective application security optimisation; implementing Privileged Access Management; implementing encryption solutions. These are examples, not individually mandatory specialisms.
• Demonstrable knowledge of information security control frameworks such as Secure Controls Framework and ISO27002.
• Demonstrable knowledge of NIS2.
• Demonstrable experience with security management techniques and/or frameworks, for example ISO27000 series, COBIT for Security, NIST, OWASP and CIS Critical Security Controls for Effective Cyber Defense. Explicitly Should have in Skills; also stated without a priority in Description.
• Demonstrable knowledge and experience through certifications appropriate to the expertise domain, for example CISM, CISSP or CEH. The certificates are examples, not three independently required certificates. Explicitly Should have in Skills; also stated without a priority in Description.
• Demonstrable knowledge of the Factor Analysis for Information Risk (FAIR) method.
• Demonstrable knowledge of the Mitre ATT&CK framework.