Freelance klantspecifiek THRIX

We are looking for an Information Security Analyst reporting to the CISO.

Practical
Location: Aartselaar, 3 days/week on site
Work regime: part-time 3/5
Duration: as soon as possible - 31/12/2027

Role
The client is preparing for NIS2 and the associated audit (essential level). As a second-line analyst, you independently assess the evidence provided by the domains (first line) according to CyFun. The first line remains responsible for self-assessment, evidence, and remediation; the CISO supports with methodology and escalation. Initially, work is focused on the important level, after April 2027, preparation for the essential level follows.

The consultant is responsible for:
- Assessing documentation and implementation evidence based on CyFun guidance
- Validating that evidence supports the scores and is not based on assumptions
- Providing feedback to domain owners with specific improvement points
- Building a file including evidence register, ready to be presented to the auditor without rework
- Supporting NIS2 implementation and audit preparation

Required experience and skills
- 3 to 6 years of experience in information security, compliance, or IT audit (mid-level IT Security Analyst, recent experience)
- Familiar with control frameworks such as CyFun, ISO 27001, and/or NIST CSF
- Experience with audit (intermediate)
- Ability to interpret and assess technical evidence: configuration exports, log files, tickets, recovery and scan reports
- Critical, analytical, and independent attitude
- Non-operational profile: pentesting, SOC, or engineering are not part of the role
- Dutch native or bilingual; English is a plus

Additional selection question
- What is your experience in CyFun implementations for essential organizations?