Information Security Governance Expert (NIS2, CyFun, EASM)

HumanInTech; Brussel Hoofdstad; Hybrid; EUR 80,000 - 120,000; Full time

Job summary

HumanInTech is seeking an experienced information security governance professional in Brussels for a hybrid, 3/5 role. The assignment runs 1 December 2026 to 30 June 2027, with on-site Brussels presence two days per week and flexible remote work. Start by 15 December 2026.

Freelance or employee path available, with potential extension. The role requires 6–10 years in information security governance or risk management, with French language proficiency and Belgian regulatory knowledge.

Qualifications

• At least five years in information security governance or risk management.
• Experience implementing NIS2 or Belgian laws in organisations.
• Led at least one maturity assessment or gap analysis against a security framework.
• Built and analysed security risk registers with business stakeholders.

Responsibilities

• Perform NIS2 maturity assessments and gap analyses across numerous artefacts.
• Design and maintain the security risk management framework (strategy, appetite, risk register, treatment plans).
• Drive EASM initiative: asset discovery, prioritisation and remediation tracking with IT provider.
• Draft and secure adoption of priority security policies by directorates.
• Support directorates integrating security controls with network, DPO, data protection and quality teams.
• Produce indicators and management committee decision documents.

Skills

BIA & business continuity

Facilitating workshops

NIS/NIS2 directives

Maturity assessment & gap analysis

ISMS (ISO/IEC 27001)

ISO 27005 risk analysis

Writing security policies

Security frameworks (CyFun/ISO27002/NI

Risk registers & treatment plans

Education

Bachelor's degree or higher

Job description

What you will do

You will work directly with the CISO to prepare and deliver information security governance initiatives across the organisation. This is an autonomous role where you structure work, carry results forward to the general directorates, and support them with your security expertise.

Your activities include:

• Conducting NIS2 maturity assessments and gap analysis across 40 security artefacts
• Designing the risk management framework: strategy, appetite, risk register and treatment plans
• Leading the external attack surface management (EASM) initiative: asset discovery, prioritisation and remediation tracking in collaboration with the IT service provider
• Drafting priority security policies and securing their adoption by the directorates
• Supporting the general directorates in integrating security controls, working with the network centre, data protection and quality teams, the DPO and the IT service provider
• Producing indicators and decision documents for the management committee

What we are looking for

You have at least five years of professional experience in information security governance or security risk management.

Essential experience:

• Participation in NIS2 directive implementation (or Belgian law of 26 April 2024) within an organisation
• Leading at least one maturity assessment or gap analysis against a security framework (ISO 27001, CyFun, NIST CSF) as the person responsible
• Building a security risk register and conducting risk analyses with business stakeholders (ISO 27005 or equivalent method)
• Practical experience with external attack surface management (EASM): discovering exposed assets, prioritisation and tracking remediation

Required skills:

• Business impact analysis (BIA) and business continuity
• Facilitating workshops and consultations with business directorates
• NIS and NIS2 directives (Belgian laws of 7 April 2019 and 26 April 2024): implementation
• Maturity assessment and gap analysis
• ISO/IEC 27001: information security management system (ISMS)
• ISO/IEC 27005: security risk analysis and management
• Writing security policies and procedures
• Security control frameworks: CyberFundamentals (CyFun), ISO/IEC 27002, NIST CSF
• Risk registers, treatment plans and risk appetite

Certification required:

At least one of the following: CISM, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, ISO 27005 Risk Manager.

Language:

Native or near-native French. The mission is conducted exclusively in French.

You have an energetic and autonomous profile. You enjoy structuring work, helping others and driving forward the topics you own.

The setting

This assignment runs from 1 December 2026 to 30 June 2027, part-time at 3/5.

The work is hybrid, combining on-site and remote work. On-site presence in Brussels is required two days per week for a full-time schedule, pro-rated to the part-time arrangement (so approximately one day per week for this 3/5 role).

You must be available to start by 15 December 2026 at the latest.

You can join us for this assignment as a freelancer or as an employee of HumanInTech. Same role, same team. If you join as an employee, your employment continues beyond this assignment. When it ends, we'll work together to find your next assignment.

Location: Brussels, hybrid

Work address: Belgium

Employer / contracting party: HumanInTech

Applications close (Brussels time): November 14, 2026 at 1:00 AM

Engagement: Freelance or employed by HumanInTech

Working hours: Full-time

Experience: 6-10 years or more

Education: Bachelor's or more

Published: November 2026