Freelance CISO

Introduction

We are looking for an experienced freelance CISO for an organization in the pension sector. You will ensure that information security and digital resilience are demonstrably up to standard during a period marked by extensive legislation and major changes.

Organization

The client manages pension assets and administration for a large group of participants. Pension administration and part of the IT operations have been outsourced. As a result, information security primarily revolves around coordination, supply chain management, and effective oversight of suppliers.

The organization is in the midst of transitioning to the new pension system. At the same time, stricter requirements for digital operational resilience are in place, and the regulator is closely monitoring how pension funds manage their IT risks. You will work directly with the board, the key risk management officer, and the administrative organization.

Job Information

As CISO, you have ultimate responsibility for the information security policy and the IT risk framework. You translate regulations into concrete measures, keep suppliers on their toes, and ensure that the board can make well-informed decisions.

Core Responsibilities:

• Establish and ensure compliance with the ICT risk management framework in accordance with DORA, including the information register and the outsourcing policy.
• Third-party risk management: assessing, monitoring, and reporting on the pension administrator, asset managers, and cloud providers.
• Establish and test the process for handling IT incidents, including the requirement to report them to the regulatory authority.
• Ensuring information security and data quality during the transition to the new pension system, such as during data migration, the recording of entitlements, and changes in the data chain.
• Coordinate digital resilience testing, such as penetration tests, scenario-based tests, and crisis drills.
• Advise the board and report on cyber risks, risk appetite, and the progress of measures.
• Prepare for and assist with inquiries and investigations by the regulatory authority.

Result of the assignment:

• Demonstrable DORA compliance, with an up-to-date information register.
• A functional incident and crisis response process that has been tested with the chain of command.
• Manage supplier risks with clear agreements and reports.
• A transferable security program for the period following the assignment.

Job Requirements

• At least 3 years of experience as a CISO or senior information security advisor.
• Proven experience working at a pension fund or pension administrator (mandatory requirement).
• Knowledge of DORA, the DNB supervisory framework, and outsourcing rules in the financial sector.
• Experience evaluating suppliers and managing outsourced IT.
• You can provide advice at the executive level and explain complex risks in a way that is easy to understand.
• Excellent command of the Dutch language.

Pros

• CISSP, CISM, or CISA certification.
• Experience with the transition to the new pension system.
• Knowledge of ISO 27001/27002 and NIST CSF.
• Experience with AI governance or the AI Act.

Offer

• Duration: 6 months, with the possibility of extension
• Hours: 32–40 hours per week
• Location: hybrid, 1–2 days per week on-site
• Start date: to be determined, preferably as soon as possible

Job Application

Would you like to apply right away? Then click the "Apply" button. Do you have any questions or would you like more information? Feel free to contact Max at max@einvigi.com or call +31(0)38 211 0211.