The Business Information Security Officer (BISO) acts as the primary point of contact for business units on all information security matters. You will play a key role in embedding the "security by design" principle across projects and operations, ensuring that risks are properly identified, assessed, and mitigated.
You will operate at the intersection of business, IT, and security, supporting both delivery teams and governance initiatives, while contributing to the organization's compliance efforts (notably ISO 27001 and NIS2).
Key responsibilities
Business partnering & Security advisory:
Act as the main security point of contact for assigned business units
Support stakeholders in adopting and implementing security by design principles
Translate security risks into actionable business and technical requirements
Secure project delivery (SDLC / s-SDLC):
Integrate security requirements throughout the Software Development Life Cycle (SDLC) and Secure SDLC (S-SDLC)
Collaborate closely with architects to ensure solutions align with security standards and best practices (infrastructure, cloud, network segmentation, etc.)
Define, document, and validate security requirements for projects and RFPs
Risk management:
Identify, assess, and document information security risks
Support the business in conducting risk assessments and defining mitigation strategies
Apply recognized methodologies such as EBIOS Risk Manager (or Agile Rm) where relevant
Vendor & solution Security:
Contribute to the selection of vendors by evaluating security posture and compliance
Ensure third-party solutions meet internal security requirements
Governance, risk & compliance (GRC):
Support Theciso Ingrc activities, including:
Reviewing and updating security policies
Designing and refining procedures and processes (e.g., SDLC frameworks)
Contribute to compliance initiatives, particularly:
ISO 27001
NIS2 directive readiness
Security projects:
Support and contribute to the implementation of key security initiatives such as:
IAM (Identity & Access Management)
PAM (Privileged Access Management)
Other transversal security programs
Incident & crisis management:
Actively support the organization during security incidents or crises
Collaborate with cross-functional teams to contain, remediate, and resolve incidents
Profile & skills
Technical expertise:
Strong understanding of IT environments
Infrastructure & networks (including network segmentation)
Cloud environments (Azure, AWS, or GCP)
Proven experience embedding security into projects (SDLC / Secure SDLC)
Solid knowledge of: ISO 27001
Security governance and risk frameworks
Familiarity with: EBIOS Rm / Agile Rm (considered a strong plus)
Functional skills:
Ability to bridge the gap between technical teams and business stakeholders
Experience in risk assessment, requirements definition, and RFP processes
Strong analytical mindset with a pragmatic approach to problem-solving
Languages:
Fluent in English
French/Dutch is a strong asset