CISO

Function

Our client is seeking an experienced cybersecurity leader to strengthen and operationalize its security strategy, governance, and cyber-risk management. This consulting assignment combines oversight with pragmatic, hands-on collaboration across business and IT. The focus is on organizational leadership, risk-based decision-making, compliance, and Security by Design rather than day-to-day technical operations.

Responsibilities

• Develop, maintain, and operationalize the cybersecurity strategy, multi-year roadmap, governance framework, and target operating model.
• Establish and maintain an effective Information Security Management System, supported by practical policies, standards, and guidelines.
• Lead the cybersecurity programme, monitor its effectiveness, and ensure that operational ownership remains with the appropriate business and IT stakeholders.
• Embed cyber risks within Enterprise Risk Management and maintain the cyber-risk register, including ownership, treatment plans, and residual risks.
• Conduct or coordinate risk assessments for projects, systems, suppliers, and significant organizational changes.
• Translate technical threats and vulnerabilities into clear operational, commercial, and organizational impacts for senior management and governance bodies.
• Define meaningful cybersecurity KPIs and KRIs and report on risk exposure, maturity, programme progress, investment needs, and required decisions.
• Support compliance with ISO 27001, GDPR, NIS2, and relevant sector requirements in coordination with privacy, risk, and assurance stakeholders.
• Coordinate audits, maturity and gap assessments, control reviews, and the follow-up of remediation actions.
• Review and challenge penetration tests, technical security assessments, and risk analyses.
• Oversee material security incidents from a second-line perspective, including root-cause analysis, lessons learned, and structural improvements.
• Strengthen third-party risk management and advise on security requirements for supplier selection, contracting, outsourcing, and cloud services.
• Develop security awareness and culture initiatives, including training, phishing simulations, onboarding content, management sessions, and a network of security champions.

Security by Design and Strategic Partnership

• Lead the implementation of Security by Design across processes, projects, systems, supplier decisions, and transformation initiatives.
• Convert policy principles into workable solutions and contribute directly to analyses, examples, frameworks, and other deliverables where needed.
• Advise business, operational, and technology stakeholders on digitalization, cloud, data, AI, OT/IoT, and new service initiatives.
• Enable balanced decisions that consider security, continuity, innovation, and commercial objectives.
• Clarify accountability for risk acceptance and control implementation while independently advising, monitoring, and challenging from the second line.
• Use security as an enabler of customer trust, operational resilience, safe growth, and competitive positioning.

Experience and Expertise

• At least ten years of relevant experience in cybersecurity, information security, cyber-risk management, or security governance.
• Demonstrable experience in a senior cybersecurity leadership or advisory capacity, including multi-year transformation programmes.
• Strong knowledge of ISO 27001, NIS2, GDPR, cybersecurity governance, and cyber-risk management.
• Sufficient technical depth to critically assess penetration tests, risk analyses, and security assessments.
• Broad understanding of identity and access management, data protection, DevSecOps, detection and response, and third-party risk management.
• Experience reporting to executive management, audit committees, or boards and supporting audits and maturity assessments.
• Experience with cloud, data, AI, or broader digital transformation initiatives is a significant advantage.

Profile

• Strategic and independent, while remaining pragmatic, visible, hands-on, and delivery-focused.
• A credible advisor who can challenge constructively and influence stakeholders without relying on formal authority.
• Skilled at translating complex technical risks into clear executive language, business impact, and actionable decisions.
• Strong in stakeholder management, coalition building, and sustainable cultural change.
• Comfortable creating analyses and deliverables directly, in addition to providing strategic advice.
• Persistent in monitoring agreed risk treatments and improvement actions until ownership and results are demonstrable.
• A collaborative bridge between governance, business, and technology who makes responsibilities, options, and consequences explicit.

Practical Information

• Full-time & longterm consulting assignment.
• Hybrid working arrangement in Brussels.
• The assignment requires sufficient visibility and availability within the organization.
• Fluency in Dutch and English is required; knowledge of French is an advantage.

Contactperson & Reference

• Reference #: INCA28469
• Geert Roete
• geert.roete@i4m.be