Analist Informatieveiligheid (Tweede Lijn)

Rhox; Aartselaar; On-site; EUR 60,000 - 80,000; Full time

Job summary

Rhox is seeking a second-line information security analyst to support NIS2 implementation and audit preparation. You will independently assess documentation and implementation evidence against CyFun guidance.

Based in Antwerpen, you will review evidence, verify compliance, and build audit-ready dossiers under the CISO's guidance, ensuring gaps are clearly addressed and ready for audit readiness at the Important and Essential levels.

Qualifications

• 3 to 6 years' experience in information security, compliance or IT audit.
• Familiarity with control frameworks such as CyFun, ISO 27001 and NIST.
• Ability to assess configuration exports, logs, tickets, recovery reports and scan reports.
• A critical, analytical and independent approach.
• Dutch (native) and English.

Responsibilities

• Review evidence submitted by first-line domain owners.
• Verify that evidence supports scores without relying on assumptions.
• Give domain owners concrete feedback on gaps and improvements.
• Build audit-ready dossiers with an evidence register.
• Prepare evidence for the Important and Essential levels.

Skills

Information security

Compliance

IT audit

CyFun framework

ISO 27001

NIST

Dutch (native)

English

Job description

We're looking for a second-line information security analyst to support NIS2 implementation and audit preparation. You'll independently assess documentation and implementation evidence against CyFun guidance.

What you'll do

• Review evidence submitted by first-line domain owners.
• Verify that evidence supports scores without relying on assumptions.
• Give domain owners concrete feedback on gaps and improvements.
• Build audit-ready dossiers with an evidence register.
• Prepare evidence for the Important and Essential levels.

What you bring

• 3 to 6 years' experience in information security, compliance or IT audit.
• Familiarity with control frameworks such as CyFun, ISO 27001 and NIST.
• Ability to assess configuration exports, logs, tickets, recovery reports and scan reports.
• A critical, analytical and independent approach.
• Dutch (native).
• English.

Good to know

• No operational pentesting, SOC activities or engineering.
• You report to the CISO, with support on methodology and escalation.