Security Consultant (Senior) - Vlaamse Belastingdienst
Description
The Flemish Tax Administration is seeking one Senior Security Consultant for its Ellipsgebouw location. The assignment focuses on information security risk analysis, policies, processes and governance. The preferred assignment period runs from 1 December 2026 to 31 May 2027. The work regime is 100%, with an estimated 800 hours per person and homeworking possible.
The consultant will conduct risk analyses and draft information security guidelines. The role also involves developing information security processes and monitoring and reporting on compliance. Supporting security architects with legal provisions and risk analyses is another explicit responsibility. ISO27005 risk analysis experience, knowledge of security controls frameworks and NIS2 knowledge are mandatory.
Applicants must demonstrate at least five years of senior security consultancy experience in a relevant environment and Dutch proficiency at CEFR C2. Experience with security management frameworks, expertise-related certifications, FAIR and MITRE ATT&CK are preferred. Candidate evaluation weighs quality and price equally. The engagement is managed through Public-Sourcing under the Flemish government Framework Agreement 2022–2027, Lot 1.
Top Reasons to Apply
Shape security governance
Apply ISO27005 expertise
Support security architects
Address NIS2 compliance
Homeworking possible
Detailed Responsibilities and Skills
General skills
- At least 5 years of demonstrable senior Security Consultant experience in at least one environment such as data, infrastructure or applications.
- Demonstrable experience drafting policy documents and processes.
- Demonstrable experience analysing, optimising and documenting security processes and governance.
- Dutch-language proficiency at European CEFR level C2.
Technical skills
- Demonstrable experience conducting risk analyses according to ISO27005.
- Demonstrable expertise in a specific information security domain. Examples in the description: implementing information security management processes; vulnerability analyses and penetration tests; cost-effective application security optimisation; implementing Privileged Access Management; implementing encryption solutions. These are examples, not individually mandatory specialisms.
- Demonstrable knowledge of information security control frameworks such as Secure Controls Framework and ISO27002.
- Demonstrable knowledge of NIS2.
- Demonstrable experience with security management techniques and/or frameworks, for example ISO27000 series, COBIT for Security, NIST, OWASP and CIS Critical Security Controls for Effective Cyber Defense. Explicitly Should have in Skills; also stated without a priority in Description.
- Demonstrable knowledge and experience through certifications appropriate to the expertise domain, for example CISM, CISSP or CEH. The certificates are examples, not three independently required certificates. Explicitly Should have in Skills; also stated without a priority in Description.
- Demonstrable knowledge of the Factor Analysis for Information Risk (FAIR) method.
- Demonstrable knowledge of the Mitre ATT&CK framework.