Information Security Officer Registered EDP Auditor (RE)

As an Information Security Officer with a Registered EDP Auditor profile, you will work within the CISO Office of a government organization.

• From the 2nd line, you strengthen the control and demonstrable compliance with information security.
• You focus specifically on particular digital services and keep track of the extent to which the organization complies with applicable standards and accountability requirements.
• You develop and maintain frameworks, assess risks and control measures, and monitor improvement actions.
• From an independent position, you advise process owners and managers and critically and constructively review their approach.
• You help them gain and maintain demonstrable control over risks, while the responsibility for implementation remains with the 1st line.
• You switch between substantive analyses, collaboration with operations, and advising senior management.

What you will do.

• Advise the CISO, management, and organizational units on risks, control, and demonstrable compliance regarding specific digital services.
• Manage the second-line monitoring and accountability cycle and translate standards into frameworks, assessment criteria, and expectations for the 1st line.
• Assess the design, existence, and operation of IT control measures and perform or coordinate second-line reviews, risk analyses, and control assessments.
• Advise process owners and managers, ask critical questions, and ensure that the responsibility for implementation remains with the 1st line.
• Monitor findings and improvement measures and steer towards timely, demonstrable, and sustainable follow-up.
• Identify and escalate shortcomings, residual risks, dependencies, and structural bottlenecks to the CISO and management.
• Guide, from the 2nd line, the preparation of audits for digital services and serve as a substantive discussion partner for internal and external auditors.
• Monitor the quality, completeness, and traceability of audit information, analyze audit results, and report on risks and improvements.
• Contribute to the development of the Information Management System and the establishment of security governance.
• Coordinate with BSOs, process and control owners, privacy professionals, auditors, and technical specialists.
• Follow developments within digital services, the BIO, relevant laws and regulations, and IT auditing, and contribute to digital resilience in an agile environment.

What they ask

• A completed HBO or university education in IT auditing, information security, accountancy, or a comparable field.
• Registration as a Registered EDP Auditor with NOREA.
• Minimum of 5 years of relevant work experience in IT auditing, information security, risk management, or compliance within a complex organization.
• Demonstrable knowledge and experience with normative frameworks for digital services, associated accountability processes, and assurance requirements.
• Knowledge of relevant laws and regulations and normative frameworks, such as the BIO, ISO 27001, and ENSIA, and of compliance and governance frameworks.
• Experience with assessing the design, existence, and operation of IT control measures and with performing or guiding audits, control assessments, and risk analyses.
• Insight into IT general controls, identity & access management, logging and monitoring, change management, incident management, and continuity management.
• Strong analytical, written, and oral skills.