Information Security Governance Expert

Neurho Solutions; Brussel; On-site; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Extra-legal benefits

Job summary

Neurho seeks an Information Security Governance Expert to build and mature its information security function. You will work with the CISO to translate assessments into a practical risk approach and help management adopt security controls.

Your role includes assessing NIS2 maturity, designing risk frameworks, leading EASM activities, drafting policies, and aligning security with business teams. Fluency in French is required.

Qualifications

• Five+ years in business impact analysis within the last three years.
• Five+ years in business continuity within the last three years.
• Five+ years facilitating workshops with business management recently.
• Five+ years implementing NIS and NIS2 within the last 12 months.
• Five+ years in security maturity and gap assessments in the last three years.
• Five+ years with EASM including asset discovery and remediation in the last 12 months.
• Five+ years with ISO/IEC 27001/27002/27005 including recent use.
• Five+ years using NIST Cybersecurity Framework recently.
• Five+ years managing risk registers and risk treatment plans.
• Five+ years handling risk appetite details recently.
• Proficient in French at C2 level.

Responsibilities

• Assess NIS2 maturity and identify gaps across security artefacts.
• Design risk management approach including risk appetite and registers.
• Lead external attack surface management from discovery to remediation.
• Draft priority security policies and drive adoption by management.
• Assist business units in integrating controls with stakeholders.
• Prepare indicators and decision papers for leadership.

Skills

NIS2 implementation

NIS maturity assessment

Risk management

EASM (External Attack Surface

ISO/IEC 27001

ISO/IEC 27005

ISO/IEC 27002

NIST Cybersecurity Framework

Risk registers & treatment plans

CyberFundamentals (CyFun)

Policy drafting

Security governance

Security risk assessment

Workshops with management

French proficiency (C2)

Tools

CISM/CISA/CISSP or equivalent

ISO 27001 Lead Implementer/Auditor

Job description

We are looking for an Information Security Governance Expert to help build an information security function and advance its NIS2 and CyberFundamentals roadmap. Working alongside the CISO, you will turn assessments into a practical risk management approach and support business management in adopting security controls.

Your role

• Assess NIS2 maturity and identify gaps across security artefacts.
• Design the risk management approach, including risk appetite, the risk register and treatment plans.
• Lead external attack surface management, from discovering exposed assets to prioritising and tracking treatment.
• Draft priority security policies and support their adoption by management.
• Help business teams integrate security controls, working with security and data protection stakeholders.
• Prepare indicators and decision papers for management.

You have

• At least five years of business impact analysis experience, used within the past three years.
• At least five years of business continuity experience, used within the past three years.
• At least five years of experience facilitating workshops and consultations with business management, including within the past three years.
• At least five years of experience implementing NIS, including use within the past 12 months.
• At least five years of experience implementing NIS2, including use within the past 12 months.
• At least five years of experience in security maturity assessment, including within the past three years.
• At least five years of experience in security gap assessment, including within the past three years.
• At least five years of experience with EASM, including asset discovery, prioritisation and treatment follow-up, and use within the past 12 months.
• At least five years of experience with ISO/IEC 27001 information security management systems, including within the past three years.
• At least five years of experience with ISO/IEC 27005 security risk analysis and management, including within the past three years.
• At least five years of experience drafting security policies, including within the past three years.
• At least five years of experience drafting security procedures, including within the past three years.
• At least five years of experience with CyberFundamentals (CyFun), including use within the past 12 months.
• At least five years of experience with ISO/IEC 27002, including use within the past 12 months.
• At least five years of experience with the NIST Cybersecurity Framework, including use within the past 12 months.
• At least five years of experience with risk registers, including within the past three years.
• At least five years of experience with risk treatment plans, including within the past three years.
• At least five years of experience with risk appetite, including within the past three years.
• French at C2 level.

A plus

• At least five years of experience as a risk management expert, including within the past 12 months.
• At least five years of professional experience in information security governance or security risk management.
• Experience leading a security maturity assessment or security gap assessment.
• CISM, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, or ISO 27005 Risk Manager certification.
• Ability to prepare work independently and present its results.
• A structured approach to advancing security initiatives.

Working at Neurho

Founded in 1998, Neurho is a Belgian IT and business consultancy. For more than 25 years, we have been helping banks, insurers, energy companies and public institutions in Belgium and Luxembourg with their transformation projects. At Neurho, you work on varied and challenging assignments, where your expertise is recognised and your growth encouraged. On top of your salary, you enjoy many extra-legal benefits, designed to suit your role, your needs and your personal wishes.

Neurho is committed to equal opportunity and welcomes every application, regardless of age, origin, nationality, gender, social background, beliefs or disability.