A government organization is tasked with further implementing and operationalizing the Information Security Management System (ISMS) in accordance with BIO2 and the NIS2/Cybersecurity Act. For this, it is necessary to strengthen both governance and steering, as well as to realize a coherent system of tactical policy documents.
What you will do. The contractor will fulfill the role of Project Leader ISMS Implementation & Policy Development and is responsible for directing progress and substantively drafting policy frameworks. The role combines:
- Direction and coordination (approx. 40–50%)
- Policy development (approx. 50–60%)
The project leader acts as a central linking pin between the program, ISOs, line organization, and control functions, ensuring demonstrable progress on strategic and tactical information security issues.
Objective of the assignment:
- Realize a functional and demonstrable ISMS
- Draft coherent tactical policy documents
- Ensure that GAP analyses and improvement measures for the "crown jewels" are executed systematically and timely
- Establish and strengthen governance and steering on information security
Result areas and activities:
- Strictly manage planning, milestones
- Maintain an integral overview of all ISMS activities
- Ensure coherence between policy, execution
- Coordinate the execution of GAP analyses, reports, and improvement proposals for the "crown jewels"
- Establish and monitor an integral planning and roadmap
- Develop and implement uniform formats and templates for GAP analyses, risk assessments, and improvement plans
- Collaborate/coordinate with the Project Leader Process, Risk, Quality, and Business Continuity Management
- Draft coherent policy documents
- Actively gather input from ISOs, process owners, CISO, and other stakeholders, and organize coordination and working sessions
- Process input into supported policy documents
- Further elaborate roles, responsibilities, and mandate (RASCI)
- Contribute to the establishment of governance in accordance with the Three Lines Model
- Strengthen coherence between information security, privacy, audit
Deliverables:
- Established set of prioritized tactical ISMS policy documents
- Coherent policy framework
- Established and implemented formats and templates for GAP analyses, risk assessment, improvement plans
- Described and implemented uniform working method for execution within the organization
- Organization-wide overview of executed GAP analyses and current/target situation
- Insight into key risks, gaps
- Established and functional ISMS process (PDCA cycle)
- Implemented and used ISMS tooling
- Demonstrable link between policy, risks, measures
- Integral ISMS roadmap (0–18 months)
- Overview of planned and ongoing improvement measures
What they ask
- Minimum 3 years of demonstrable work experience as a project leader, program manager, and/or quartermaster with a focus on planning, progress, and realization of implementation projects
- Minimum 3 years of demonstrable work experience with information security, governance, compliance, process management, and/or quality management
- Demonstrable work experience with information security and ISMS implementations (e.g., ISO 27001, BIO/BIO2), including setting up processes, governance, and/or tooling
- Minimum 1 year of demonstrable work experience in drafting policy documents within a government organization
- 'Bring your own device' applies
Wishes.
- Minimum 3 years of demonstrable work experience as a project leader guiding ISMS implementations or information security projects
- Minimum 2 years of demonstrable work experience in drafting tactical ISMS policy documents within a government organization
- Demonstrable work experience in establishing and monitoring plans and roadmaps
- Demonstrable completed education at a minimum of HBO bachelor level
Profile
- Responsibility
- Directing
- Collaboration
- Vision
- Creativity
How to apply
View the full assignment text and application details once your tailored application is ready.
Order a tailored application to view the full assignment and application details.
More context, less searching.
You get enough context to judge whether this job is relevant. The full brief, client details and next steps stay available inside the app.