Chief Information Security Officer

Harvey Nash; Brussel Hoofdstad; On-site; EUR 166,000 - 277,000; Part time

Job summary

Harvey Nash is seeking a freelance Chief Information Security Officer (External CISO) to strengthen cybersecurity strategy, governance, and risk management within a regulated services environment. The role reports to Corporate Legal, Risk & Compliance, with collaboration across Executive Management, Business, IT, and Audit teams.

The assignment emphasizes strategy over day-to-day operations, with a first focus on Security by Design to embed security in projects, processes, and supplier

Qualifications

• At least 10 years of cybersecurity experience including governance or risk management.
• Demonstrable experience as a CISO, vciso, or senior cybersecurity advisor.
• Knowledge of ISO 27001, NIS2, GDPR, cyber risk management, and governance.
• Strong IAM, data protection, DevSecOps, detection/response, and third-party risk management knowledge.
• Experience reporting to executives, Audit Committees, or Boards.

Responsibilities

• Develop and operationalise the cybersecurity strategy and multi-year roadmap.
• Maintain the ISMS, governance framework, and target operating model.
• Translate risk profiles into priorities, milestones, and budgets; define responsibilities.
• Lead Security by Design initiatives and ensure security in projects, suppliers, and changes.
• Advise on digitalisation, cloud, data, and AI initiatives; balance security with business needs.
• Maintain cyber risk register, risk owners, treatment plans, and residual risks.
• Coordinate ISO 27001, NIS2, GDPR compliance and audits; monitor findings and actions.
• Produce periodic reports to executive management, Audit Committee, and Board.
• Monitor incidents, resilience, third-party risk, and foster security awareness.

Job description

Chief Information Security Officer (External CISO)

Freelance Assignment

Positioning: Second Line of Defense

Collaboration: Executive Management, Business, IT, Enterprise Risk Management, DPO, and Internal and External Audit

1. About the Assignment

Our client is an established professional services organization operating in a regulated environment, where information security, risk management, compliance, and customer trust are essential to business continuity and sustainable growth.

The organisation is looking for an experienced freelance Chief Information Security Officer (CISO) to strengthen its cybersecurity strategy, governance, and cyber risk management.

Embedded within Corporate Legal, Risk & Compliance, the External CISO will provide independent oversight and challenge from the Second Line of Defense, while working closely with Business and IT to ensure that cybersecurity principles are translated into practical solutions.

This is a strategic and hands-on assignment. The CISO will establish the cybersecurity framework, guide the organisation's security priorities, support the implementation of key initiatives, and report independently on risks and programme effectiveness. The role focuses on strategy, governance, risk management, and compliance rather than day-to-day technical operations.

A key priority during the first 6 to 12 months will be the development and implementation of the strategic Security by Design programme, ensuring that security is integrated into projects, processes, systems, supplier selection, and digital initiatives from the outset.

The CISO is expected to provide direction, build stakeholder support, and influence decisions through expertise and credibility rather than formal authority.

2. Key Responsibilities

A. Cybersecurity Strategy and Governance

• Develop, maintain, and operationalise the cybersecurity strategy and multi-year roadmap.
• Establish and maintain the Information Security Management System (ISMS), cybersecurity governance framework, and Target Operating Model.
• Translate the organisation's risk profile into priorities, milestones, investment requirements, and clear responsibilities.
• Develop practical security policies, standards, and guidelines.
• Coordinate the cybersecurity programme, monitor its progress and effectiveness, and ensure alignment between initiatives.
• Promote shared accountability for cybersecurity across Business and IT, including through a network of security champions.

B. Security by Design and Business Partnership

• Lead the development and implementation of the Security by Design programme.
• Ensure security is incorporated into projects, processes, systems, supplier decisions, and organisational change initiatives from the outset.
• Work hands‑on with Business and IT teams to translate security policies and principles into concrete solutions, analyses, and deliverables.
• Advise on strategic initiatives involving digitalisation, cloud, data, AI, OT/IoT, and new services.
• Help stakeholders balance security requirements with business objectives, operational continuity, and innovation.
• Integrate cyber risks into the broader Enterprise Risk Management framework.
• Maintain the cyber risk register, including risk owners, treatment plans, and residual risks.
• Conduct or coordinate risk assessments for projects, systems, suppliers, and significant organisational changes.
• Define proportionate control measures and explain the operational, commercial, and organisational impact of technical risks.
• Advise on risk treatment and monitor agreed actions, ensuring that risk ownership, risk acceptance, and implementation remain with the appropriate Business and IT stakeholders.

D. Compliance, Assurance, and Security Assessments

• Support compliance with ISO 27001, NIS2, GDPR, and relevant sector-specific obligations, in coordination with the Data Protection Officer (DPO).
• Coordinate or support audits, maturity assessments, gap assessments, and risk‑based control assessments.
• Review and challenge penetration tests, technical security assessments, and risk analyses.
• Monitor audit findings and improvement actions through to completion.

E. Reporting and Executive Advisory

• Develop relevant cybersecurity Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs).
• Report periodically on the cybersecurity risk profile, residual risks, maturity, programme progress, investment needs, and required decisions.
• Prepare reports for executive management, the Audit Committee, and the Board of Directors.
• Translate complex technical risks into clear business implications and demonstrate how security investments contribute to risk reduction, compliance, business continuity, and customer trust.
• Independently escape material risks and deficiencies when necessary.

F. Cyber Resilience and Third-Party Risk

• Monitor significant security incidents from the Second Line of Defense perspective, including root‑cause analyses, lessons learned, and structural improvement actions.
• Advise on incident preparedness, detection, response, and recovery, ensuring that responsibilities are clearly defined.
• Support the Third‑Party Risk Management framework and periodic security assessments of critical suppliers.
• Advise on security requirements relating to supplier selection, contracting, outsourcing, and cloud solutions.

G. Security Awareness and Culture

• Develop and support an organisation‑wide security awareness programme, including training, phishing simulations, onboarding modules, and management sessions.
• Promote secure behaviour and shared accountability for cybersecurity.
• Build stakeholder coalitions and encourage the adoption of security practices across the organisation.

Strategy and governance

Updated cybersecurity strategy, multi-year roadmap, governance framework, and Target Operating Model.

ISMS and policies

Maintained ISMS, security policies, standards, and practical guidelines.

Security by Design

Implementation roadmap, framework, and hands‑on support for priority Business and IT initiatives.

Updated risk register, risk assessments, treatment plans, and monitoring of residual risks.

Compliance and assurance

ISO 27001 gap assessment, control assessment programme, and follow‑up of audit findings.

Reporting

Cybersecurity KPIs and KRIs, with periodic management and board‑level reporting.

Resilience and third parties

Supplier risk management approach, incident lessons learned, and structural improvement actions.

Awareness and culture

Security awareness programme supported by clear communication and security champions.

4. Required Profile

Experience and Technical Expertise

• At least 10 years of relevant experience in cybersecurity, information security, cyber risk management, or cybersecurity governance.
• Demonstrable experience as a CISO, virtual CISO (vCISO), or senior cybersecurity advisor.
• Experience developing and managing multi‑year cybersecurity or transformation programmes.
• In‑depth knowledge of ISO 27001, NIS2, GDPR, cyber risk management, and cybersecurity governance.
• Sufficient technical expertise to assess penetration tests, risk analyses, and security assessments critically.
• Broad knowledge of Identity and Access Management (IAM), data protection, DevSecOps, detection and response, and Third‑Party Risk Management.
• Experience reporting to executive management, an Audit Committee, or a Board of Directors, as well as working with audits and maturity assessments.
• Experience with digitalisation, cloud, data, or AI initiatives is a significant advantage.

Professional Competencies and Working Style

• Strong strategic thinking combined with a pragmatic, hands‑on, and results‑oriented approach.
• Excellent stakeholder management and the ability to influence without relying on formal authority.
• Ability to translate complex technical risks into clear business implications and actionable recommendations.
• Independence and objectivity when advising and challenging stakeholders, while respecting the responsibilities of Business and IT.
• Willingness to contribute directly to analyses, practical solutions, and other deliverables, in addition to providing strategic advice.
• Strong communication, negotiation, and coalition‑building skills.
• Ability to drive sustainable changes in security culture and establish clear ownership of responsibilities.
• Persistence in monitoring agreed risk treatment measures and improvement actions until results are demonstrable.

5. Positioning and Collaboration

The External CISO will be embedded within Corporate Legal, Risk & Compliance and operate independently within the Second Line of Defense.

The role involves close collaboration with executive management, Business, IT, Enterprise Risk Management, the DPO, Internal and External Audit, and the owners of critical processes, systems, and risks.

The CISO will have direct access to executive management, the Audit Committee, and the Board of Directors, with the ability to elevate material risks and deficiencies independently.

The division of responsibilities is essential: the CISO establishes the framework, provides independent advice and challenge, and monitors cybersecurity risks and controls. Business and IT remain accountable for their risks, risk acceptance, control implementation, and day‑to‑day operational execution.

The assignment is specifically focused on information security and cybersecurity and does not include a general DPO or legal advisory function.

6. Nature of the Assignment

The assignment will be performed by an independent service provider who organizes the work autonomously within the agreed objectives, priorities, deliverables, and reporting arrangements.

The role requires sufficient availability and visibility within the organization, combining independent oversight with active, pragmatic support for Business and IT.