Head of Information and Cyber Security

Onodrim Industries; Amsterdam; On-site; EUR 150,000 - 210,000; Full time

Job summary

Onodrim Industries is seeking a Head of Information Security to own security across our platform and acquired sub‑cos. You will set strategy, manage identity and endpoint security, and extend security to shop floor OT/ICS across Europe.

You will drive regulatory readiness (NIS2, ISO 27001, GDPR, export controls), lead incident response, and oversee corporate IT for a small, growth‑oriented organisation. Strong English, travel willingness, and EU work rights are required.

Qualifications

• 5+ years in information security.
• Experience with a modern cloud-native stack and enterprise identity provider.
• Hands-on with identity, access, and endpoint management.
• Experience securing on-premise and industrial environments (Windows domains, ERP, OT/ICS).
• Incident response leadership.
• Knowledge of European defence/regulatory landscape (NIS2, ISO 27001, GDPR, export controls).
• Experience achieving ISO 27001 from scratch.
• Comfort with corporate IT and vendor management.
• Strong judgement on build vs. buy/offshore vs. MSSP/MDR—cost and risk.
• Clear English communication; willingness to travel across Europe.
• Right to work in EU/UK; security clearance eligibility.

Responsibilities

• Own the security programme across Onodrim and sub‑cos, setting strategy, standards and risk appetite.
• Run and harden identity, access, endpoints, and SaaS stack across the platform.
• Bring acquired companies onto platform standards quickly post‑acquisition without disrupting production.
• Support deal teams with security/IT due diligence on targets and cost of fixes.
• Protect shop floor OT/ICS: network segmentation, machine access, vendor remote access.
• Lead incident response: detection, response, and recovery, including tabletop exercises.
• Drive ISO 27001, NIS2 readiness and export-control compliance on the technical side.
• Manage third‑party and supply‑chain risk: vendors, cloud providers, auditors.
• Run Top-Co corporate IT: device procurement, onboarding/offboarding, SaaS licensing, first-line support.
• Define sub‑co IT model; decide consolidation vs. local IT, and plant IT integration.
• Build the function: hire security/IT staff; manage MSSPs, MDRs, auditors.
• Make security usable: write policies, train staff, and design practical controls.

Skills

Information security

Cloud-native stack

Identity provider

Endpoint management

SaaS security

On-premise security

Industrial environments

Windows domains

Legacy ERP

OT/ICS

Incident response

NIS2

ISO 27001

GDPR

Export control

Security clearance eligibility

ISO 27001 certification

Device management

SaaS administration

Onboarding/offboarding

Build vs buy

English communication

Travel willingness

Right to work

Security clearance

UK SC/DV clearance

German Ü2/Ü3

NATO Secret

Defence contractor

M&A security

OT security

Security engineering

CISSP

CISM

Scale-up experience

Job description

About The Role

Onodrim is building Europe's largest defence and industrial platform. We acquire specialist manufacturers in critical defence and dual-use supply chains, then invest behind their growth with capital, technology and operating know-how.

Onodrim is building Europe's largest defence and industrial platform. We acquire specialist manufacturers in critical defence and dual-use supply chains, then invest behind their growth with capital, technology and operating know-how. The Head of Information Security owns security across the whole platform: Onodrim itself and every company we acquire. A defence platform with investor backing is a target for state actors, criminal groups and everyone in between. Our acquired companies arrive with their own networks, their own IT people and their own history - and they build things that must not leak. You'll set the standard, make it real at each site, and be the person who picks up the phone when something goes wrong.

This is a hands‑on role. Onodrim itself is a small, young company. You'll take over its security from the CTO on day one and run it yourself, then extend it to sub‑cos that look nothing like it: on‑premise ERP, shop‑floor networks, machine controllers, and a plant IT administrator who has done everything alone for fifteen years.

Alongside security you'll own the basics of corporate IT for Onodrim - identity and access, devices, SaaS administration, onboarding and offboarding - and set the model for how sub‑co IT is run and, where it makes sense, consolidated.

What You'll Do

• Own the security programme. Set Onodrim's security strategy, standards and risk appetite
• Run Onodrim's own estate. Operate and harden identity and access, endpoint management, the productivity suite and the rest of the SaaS stack
• Secure the sub‑cos. Within the first weeks after each acquisition, assess the company's security posture, fix what is urgent, and bring it onto the platform standard over time - without disrupting production
• Support the deal team. Run security and IT due diligence on acquisition targets: what they run, what has happened to them, what it will cost to fix, and what could kill the deal
• Protect the shop floor. Bring OT and industrial control systems into scope: network segmentation, machine access, vendor remote access, and the gap between the IT and OT teams
• Lead incident response. Own detection, response and recovery across the platform; run tabletop exercises; be the escalation point when something happens at 02:00 at a sub‑co
• Get and keep the certifications that unlock business. Drive ISO 27001, NIS2 readiness and the national defence‑industry and classified‑information requirements (e.g. BSI, Facility Security Clearance equivalents) that our customers and partners demand, and support export‑control compliance (ITAR/EAR, EU dual‑use) on the technical side
• Manage third‑party and supply‑chain risk. Assess vendors, cloud providers and partners; put the right contractual and technical controls in place
• Run corporate IT for the Top‑Co. Own device procurement and lifecycle, joiner/mover/leaver, SaaS licensing and administration, and first‑line support - either directly or through a managed provider you select and manage
• Set the sub‑co IT model. Decide what gets consolidated (identity, email, endpoint, backup), what stays local, and how plant IT teams plug into the platform
• Build the function. Hire and manage security and IT staff as the platform grows; select and manage MSSPs, MDR providers and auditors in the meantime
• Make security usable. Write policies people can follow, train staff, and design controls that a 20‑person company and a 500‑person manufacturer can both live with

What you'll bring

• 5+ years in information security, with at least 2 in a role where you owned the programme - Head of Security, CISO or deputy at a company of similar or larger scale, or equivalent responsibility in government, military or a defence contractor
• Deep hands‑on experience with a modern cloud‑native stack: an enterprise identity provider, Apple and Windows endpoint management, cloud productivity‑suite administration, and SaaS security
• Experience securing on‑premise and industrial environments - Windows domains, legacy ERP, shop‑floor networks, OT/ICS - not only cloud
• A track record of leading incident response, including at least one serious incident you can talk through end to end
• Working knowledge of the European regulatory landscape for defence and critical industry: NIS2, ISO 27001, GDPR, export control (EU dual‑use, ITAR/EAR) and national classified‑information regimes
• Experience taking a company through ISO 27001 or an equivalent certification from scratch
• Comfort with corporate IT: you have run or managed device fleets, SaaS administration and onboarding, and are willing to do it yourself at a small company
• Strong judgement on build vs. buy vs. outsource - you know when to run it yourself and when to bring in an MSSP, MDR provider or auditor
• Clear, direct communication in English, written and spoken, with the ability to present risk to a board and explain controls to a plant administrator
• Willingness to travel regularly to across Europe, with extended time on site after each acquisition
• Right to work in the UK, Switzerland or the EU, and eligibility for a national security clearance in at least one of our operating countries

Nice to have

• We operate our business in English but fluency in one or more additional European languages is beneficial
• An existing national security clearance (UK SC/DV, German Ü2/Ü3, NATO Secret or equivalent)
• Experience in a defence contractor, a government security agency, or a company handling classified or export‑controlled material
• Experience with M&A security: diligence, day‑one integration playbooks, and consolidating IT across acquired companies
• Hands‑on OT security experience (IEC 62443, Purdue model, vendor remote access) in manufacturing
• Security engineering background - you can read code, review an architecture, and have opinions about how software should be built securely
• Certifications such as CISSP, CISM, ISO 27001 Lead Implementer or GIAC - or strong opinions about why they don't matter
• Experience in a scale‑up or PE‑backed platform where you built the function from one person up