Information Security Officer

SOURCE.ME; Eindhoven; Hybrid; EUR 90,000 - 115,000; Full time

Benefits offered by this job

28 days holiday

Sabbatical every 3 years (28 extra)

Travel allowance €399/month

Learning budget €2,000/year

Flexible workations

In Eindhoven area, 3 days/week in the,

Job summary

SOURCE.ME is hiring an Information Security Officer to own the ISMS end-to-end and drive improvements across the organisation. You’ll coordinate security audits, manage risk and ensure practical governance in collaboration with engineering and legal teams.

The role requires a security-minded, organised professional who can translate risk into actionable decisions and influence architecture reviews. Hybrid work with onsite presence in Eindhoven area is expected.

Qualifications

• Own the ISMS end-to-end and drive improvements.
• Coordinate security audits and evidence collection across teams.
• Translate security risk into clear, actionable decisions.
• Collaborate with engineering, platform, legal and support.

Responsibilities

• Lead ISMS implementation and maintenance.
• Prepare for internal and external audits.
• Develop practical security policies and governance.
• Manage vendor risk and incident response workflows.

Skills

ISMS ownership

Security governance

Audit coordination

Risk management

Tools

ISO 27001

Job description

Information Security Officer | Netherlands

I'm working with a logistics-tech platform shipping high volumes of parcels for retailers big and small, plugged into dozens of carriers, running across multiple markets at once. Looks simple from the outside. Underneath, it's anything but.

They're looking for an Information Security Officer to make sure none of it becomes a headline.

You'll be coordinating, chasing and delivering. Execution on the technical side sits with the security engineer and ops, your job is to own the whole cycle and make sure nothing falls through the cracks.

You'll be responsible for owning the ISMS end to end. Think security questionnaires, audit prep, internal audits, documentation, and the improvement projects that actually get shipped, not just written up.

Working alongside engineering, platform, legal and support, you'll be the one turning security risk into clear decisions, not just more documentation.

The philosophy is simple: your job is to make the safe path the easy path.

What's in scope :

• ISO 27001 is key. Internal audits, evidence, management reviews, corrective actions and external audit readiness
• Security questionnaires and audit prep
• Risk management that leads to decisions. A living risk register, not a spreadsheet nobody opens
• Security governance, practical policies for access, data handling, vendor risk and incident response
• Vendor and third party risk, tiering, due diligence and ongoing assurance
• Incident governance, from classification through to the post incident learning that stops it happening twice
• A seat at the table in architecture reviews, as the security voice, not the decision maker

But nobody's hiring off a certificate stack.

If you're used to a team of analysts backing you up, this isn't that. It's just you, coordinating everyone else. Certifications help, but character matters more here: organised, communicative, and happy wearing a couple of different hats.

For someone ideally on their second or third role in security. You've run or co-run an ISMS before, probably as the number two to someone more senior, and you're ready to own it outright.

Now, what's on offer?...< /p>

• Comp in the €90k-€115k range, expert level, band under review
• Permanent contract from day one
• 28 days holiday, and birthday off
• 28 extra days sabbatical every 3 years
• €399 a month travel allowance
• Flexible workations
• €2,000 a year for learning
• Eindhoven area, three days a week in the office as standard

There's more, but won't spoil it just yet

This one's worth the virtual coffee, trust me.