About the mission
We are looking for an Information Security Analyst (Second Line) to support NIS2 implementation and audit preparations. The role involves assessing documentation quality and providing feedback for improvement. Candidates should have 3 to 6 years of experience in information security or IT audit and be familiar with control frameworks.
Read the full description
IMPORTANT INFORMATION
Only applications that meet the criteria set by Aquafin (skills, work experience, language knowledge, and availability) in this job post will be considered. If the above is not respected, Aquafin and/or ProUnity reserve the right to reject the application. Attached you will find various documents that are an integral part of the 'Statement of Work' and are expected to be read and approved at the start of the consultant.
About Aquafin
At Aquafin, we connect people with water through technology. We lead change and work towards an environment in harmony with water. We do this through water purification and sewage, but also through innovation and energy transition.
Every day we contribute to better water quality and a healthy living environment. We realize infrastructure projects that collect and purify household wastewater and continuously work on optimizing our existing networks and installations. This supports the ambition to achieve ecological objectives for our waterways.
About the job
As an Information Security Analyst (Second Line), you will support the NIS2 implementation and the preparations for the audit for our organization (essential).
In this second-line role, you will independently assess the quality of documentation evidence and implementation evidence provided by the domains (first line) based on CyFun guidance. You will also validate that the evidence supports the scores and that they are not based on assumptions so that they will pass the external auditor's assessment. You will provide feedback to the domain owners and formulate concrete improvement points for them to work on.
Additionally, you will engage in file building, including a proof register that can be presented to the auditor without reworking.
We will first work towards the important level and you will continue to support the preparation for the essential level after April 2027.
You have 3 to 6 years of experience in information security, compliance, or IT audit. You are familiar with control frameworks such as CyFun, ISO 27001, and/or CIST CSF. You are able to interpret and assess technical evidence such as configuration exports, log files, tickets, recovery, and scan reports. Your role is situated in the second line and does not include operational tasks such as pentesting, SOC activities, or engineering.
The position reports to the CISO and requires a critical, analytical, and independent attitude. The CISO supports you in case of doubt, methodology, and escalation. The first line is responsible for self-assessment, providing evidence, and remediation.
Only applications that meet the criteria set by Aquafin (skills, work experience, language knowledge, and availability) in this job post will be considered. If the above is not respected, Aquafin and/or ProUnity reserve the right to reject the application. Attached you will find various documents that are an integral part of the 'Statement of Work' and are expected to be read and approved at the start of the consultant.
About Aquafin
At Aquafin, we connect people with water through technology. We lead change and work towards an environment in harmony with water. We do this through water purification and sewage, but also through innovation and energy transition.
Every day we contribute to better water quality and a healthy living environment. We realize infrastructure projects that collect and purify household wastewater and continuously work on optimizing our existing networks and installations. This supports the ambition to achieve ecological objectives for our waterways.
About the job
As an Information Security Analyst (Second Line), you will support the NIS2 implementation and the preparations for the audit for our organization (essential).
In this second-line role, you will independently assess the quality of documentation evidence and implementation evidence provided by the domains (first line) based on CyFun guidance. You will also validate that the evidence supports the scores and that they are not based on assumptions so that they will pass the external auditor's assessment. You will provide feedback to the domain owners and formulate concrete improvement points for them to work on.
Additionally, you will engage in file building, including a proof register that can be presented to the auditor without reworking.
We will first work towards the important level and you will continue to support the preparation for the essential level after April 2027.
You have 3 to 6 years of experience in information security, compliance, or IT audit. You are familiar with control frameworks such as CyFun, ISO 27001, and/or CIST CSF. You are able to interpret and assess technical evidence such as configuration exports, log files, tickets, recovery, and scan reports. Your role is situated in the second line and does not include operational tasks such as pentesting, SOC activities, or engineering.
The position reports to the CISO and requires a critical, analytical, and independent attitude. The CISO supports you in case of doubt, methodology, and escalation. The first line is responsible for self-assessment, providing evidence, and remediation.
What you'll do
- Independently assess the quality of documentation evidence and implementation evidence
- Validate that evidence supports scores and is not based on assumptions
- Provide feedback to domain owners and formulate concrete improvement points
- Engage in file building, including a proof register for auditors
- Support the preparation for essential level after April 2027
What we're looking for
- 3 to 6 years of experience in information security, compliance, or IT audit
- Familiarity with control frameworks such as CyFun, ISO 27001, and/or CIST CSF
- Ability to interpret and assess technical evidence such as configuration exports, log files, tickets, recovery, and scan reports
Skills
- CyFun
- ISO 27001
- CIST CSF