The Business Information Security Officer (BISO) acts as the primary point of contact for business units on all information security matters. You will play a key role in embedding the "security by design" principle across projects and operations, ensuring that risks are properly identified, assessed, and mitigated. You will operate at the intersection of business, IT, and security, supporting both delivery teams and governance initiatives, while contributing to the organization's compliance efforts (notably ISO 27001 and NIS2). Key responsibilities Business partnering & Security advisory: Act as the main security point of contact for assigned business units Support stakeholders in adopting and implementing security by design principles Translate security risks into actionable business and technical requirements Secure project delivery (SDLC / s-SDLC): Integrate security requirements throughout the Software Development Life Cycle (SDLC) and Secure SDLC (S-SDLC) Collaborate closely with architects to ensure solutions align with security standards and best practices (infrastructure, cloud, network segmentation, etc.) Define, document, and validate security requirements for projects and RFPs Risk management: Identify, assess, and document information security risks Support the business in conducting risk assessments and defining mitigation strategies Apply recognized methodologies such as EBIOS Risk Manager (or Agile Rm) where relevant Vendor & solution Security: Contribute to the selection of vendors by evaluating security posture and compliance Ensure third-party solutions meet internal security requirements Governance, risk & compliance (GRC): Support Theciso Ingrc activities, including: Reviewing and updating security policies Designing and refining procedures and processes (e.G., SDLC frameworks) Contribute to compliance initiatives, particularly: ISO 27001 NIS2 directive readiness Security projects: Support and contribute to the implementation of key security initiatives such as: IAM (Identity & Access Management) PAM (Privileged Access Management) Other transversal security programs Incident & crisis management: Actively support the organization during security incidents or crises Collaborate with cross-functional teams to contain, remediate, and resolve incidents Profile & skills Technical expertise: Strong understanding of IT environments Infrastructure & networks (including network segmentation) Cloud environments (Azure, AWS, or GCP) Proven experience embedding security into projects (SDLC / Secure SDLC) Solid knowledge of: ISO 27001 Security governance and risk frameworks Familiarity with: EBIOS Rm / Agile Rm (considered a strong plus) Functional skills: Ability to bridge the gap between technical teams and business stakeholders Experience in risk assessment, requirements definition, and RFP processes Strong analytical mindset with a pragmatic approach to problem-solving Languages: Fluent in English French/Dutch is a strong asset