Security Consultant (Senior) - Vlaamse Belastingdienst

Adjugo; Oost-Vlaanderen; Ibrido; EUR 75.000 - 105.000; Tempo pieno

Vantaggi offerti da questo lavoro

Homeworking possible

Descrizione del lavoro

The Flemish Tax Administration seeks a Senior Security Consultant for its Ellipsgebouw location. The role focuses on information security risk analysis, policies, processes and governance, with ISO27005 and NIS2 knowledge mandatory.

Homeworking is possible, and the engagement runs from 1 December 2026 to 31 May 2027. Responsibilities include drafting guidelines, developing security processes, and supporting security architects on legal provisions and risk analyses.

Competenze

• At least five years of senior Security Consultant experience in a relevant environment.
• Dutch CEFR C2 proficiency required.
• ISO27005 risk analysis experience mandatory.
• Knowledge of security controls frameworks and NIS2 required.
• Certifications in security (e.g., CISM/CISSP/CEH) encouraged but not required.

Mansioni

• Draft information security guidelines.
• Develop information security processes.
• Monitor and report information security compliance.
• Support security architects on legal provisions and risk analyses.
• Conduct ISO27005 risk analyses and advise on security controls.

Conoscenze

ISO27005 risk analysis

NIS2 knowledge

Security controls frameworks

FAIR method

MITRE ATT&CK

CEFR C2 Dutch

Security management frameworks

Descrizione del lavoro

Dates: 2026-12-01 — 2027-05-31

Arrangements: 100% full-time; daytime work; homeworking possible; estimated 800 hours per person. On-site frequency not specified.

The Flemish Tax Administration is seeking one Senior Security Consultant for its Ellipsgebouw location. The assignment focuses on information security risk analysis, policies, processes and governance. The preferred assignment period runs from 1 December 2026 to 31 May 2027. The work regime is 100%, with an estimated 800 hours per person and homeworking possible.

The consultant will conduct risk analyses and draft information security guidelines. The role also involves developing information security processes and monitoring and reporting on compliance. Supporting security architects with legal provisions and risk analyses is another explicit responsibility. ISO27005 risk analysis experience, knowledge of security controls frameworks and NIS2 knowledge are mandatory.

Applicants must demonstrate at least five years of senior security consultancy experience in a relevant environment and Dutch proficiency at CEFR C2. Experience with security management frameworks, expertise-related certifications, FAIR and MITRE ATT&CK are preferred. Candidate evaluation weighs quality and price equally. The engagement is managed through Public-Sourcing under the Flemish government Framework Agreement 2022–2027, Lot 1.

Top Reasons to Apply

Shape security governance

Apply ISO27005 expertise

Support security architects

Address NIS2 compliance

Homeworking possible

Responsibilities

Draft information security guidelines

Develop information security processes

Monitor and report information security compliance

Support security architects on legal provisions and risk analyses

Must Have

Security consultancy experience

Policy and process drafting

ISO2705 risk analysis experience

Security process governance experience

Information security domain expertise

Security controls framework knowledge

NIS2 knowledge

Dutch CEFR C2 proficiency

Nice to Have

Security management framework experience

Domain relevant security certifications

FAIR method knowledge

MITRE ATT&CK framework knowledge

Detailed Responsibilities and Skills

• At least 5 years of demonstrable senior Security Consultant experience in at least one environment such as data, infrastructure or applications.
• Demonstrable experience drafting policy documents and processes.
• Demonstrable experience analysing, optimising and documenting security processes and governance.
• Dutch-language proficiency at European CEFR level C2.

Technical skills

• Demonstrable experience conducting risk analyses according to ISO27005.
• Demonstrable expertise in a specific information security domain. Examples in the description: implementing information security management processes; vulnerability analyses and penetration tests; cost-effective application security optimisation; implementing Privileged Access Management; implementing encryption solutions. These are examples, not individually mandatory specialisms.
• Demonstrable knowledge of information security control frameworks such as Secure Controls Framework and ISO27002.
• Demonstrable knowledge of NIS2.
• Demonstrable experience with security management techniques and/or frameworks, for example ISO27000 series, COBIT for Security, NIST, OWASP and CIS Critical Security Controls for Effective Cyber Defense. Explicitly Should have in Skills; also stated without a priority in Description.
• Demonstrable knowledge and experience through certifications appropriate to the expertise domain, for example CISM, CISSP or CEH. The certificates are examples, not three independently required certificates. Explicitly Should have in Skills; also stated without a priority in Description.
• Demonstrable knowledge of the Factor Analysis for Information Risk (FAIR) method.
• Demonstrable knowledge of the Mitre ATT&CK framework.