IT Security Officer

• ISMS ownership: act as information security lead and point of contact for ISO 27001, internally and towards the certification body.
• Maintain controls, evidence, and the risk register in a compliance platform, and keep the Statement of Applicability current.
• Advise Management and HR on these matters.
• Risk management: run the information security risk process and deliver a dated, management-approved risk assessment report.
• Corrective actions and audits: drive open corrective actions from internal and external audits to closure with evidence, co-run the internal audit programme with the Quality Manager, and prepare for and attend the next external audit.
• Policies: update and roll out information security policies, including physical security for offices, information classification, acceptable use, access control, change management, and business continuity.
• Access governance: map admin rights across business systems, set up backup admins and account recovery that do not depend on one person, run periodic access reviews, and ensure leavers' accounts are closed in every tool.
• Suppliers and software: keep a register of SaaS tools and licenses with owners, set the approval route for new software and AI tools, and assess the security side of supplier changes such as network and firewall updates.
• Awareness and continuity: run security awareness activities and business continuity tabletop exercises, and record and follow up security incidents with the IT team.

What they ask

• 2+ years of hands-on experience implementing or maintaining ISO/IEC 27001:2022, including at least one external certification or surveillance audit.
• A solid IT background: cloud and SaaS (e.g., Google Workspace, Atlassian, Microsoft/Azure), identity and access management, and endpoint and network basics.
• Experience with a compliance platform, ideally Vanta (or Drata, Secureframe).
• Experience with risk assessments, Statements of Applicability, corrective actions, and internal audits.
• You work independently and in a structured way, and you write clear policies and evidence.
• Fluent English; Dutch is a plus.
• Registered as a freelancer (KvK) with your own insurance, and willing to complete pre-engagement screening.
• You are allowed to work in The Netherlands without any restrictions, and you will not need work permit / visa sponsorship.

• A clearly scoped assignment with real ownership and direct access to management.
• A diverse and international team in an innovative cleantech scale-up.
• Flexibility in how you plan your day, with part of the work possible remotely.
• A comfortable office close to a station and the highway, with access to cafeterias.
• No work permit / visa sponsorship available. No relocation package / remuneration if moving to The Netherlands is required.