Information Security Governance Expert

Mission Overview

Keystone Solutions is seeking an Information Security Governance Expert to join a consultancy mission at a client site. This role involves working closely with the Ministry of the Federation Wallonia-Brussels (MFWB) to enhance their information security function in alignment with NIS2 and the CyberFundamentals (CyFun) strategy approved by the Government.

Key Responsibilities

• Conduct the NIS2 maturity assessment and gap analysis on the 40 security artifacts of the Ministry.
• Design the risk management framework: strategy, appetite, register, and treatment plans.
• Lead the external attack surface management (EASM) initiative: discovery, prioritization, and remediation of exposures with Keystone Solutions.
• Draft priority security policies and facilitate their adoption by management.
• Support the General Administrations in integrating security controls, in collaboration with CEN, DQPS, DPO, and Keystone Solutions.
• Produce indicators and decision-making documents for the Management Committee.

Consultancy Nature: This position emphasizes on-site work and the consultant identity, allowing you to engage directly with client teams.

Dynamic Projects: You will face a variety of challenges across different client environments, ensuring no two days are the same.

Turbo-Charged Learning: This role offers extensive professional development and broad learning experiences, enhancing your expertise in information security governance.

Skyrocketing Ambition: At Keystone Solutions, we are committed to your career growth within our consultancy framework.

Values: Being a

Duration: 01/12/2026 - 30/06/2027 7 months • (part time 3/5)

Skills required

• Analyse d’impact métier (BIA) et continuité d’activitéConfirmed · last used 1 to 3 years ago
• Animation d’ateliers et de concertations avec des directions métierConfirmed · last used 1 to 3 years ago
• Directives NIS et NIS2 (lois belges du 7 avril 2019 et du 26 avril 2024) : mise en œuvreConfirmed · used this year
• Évaluation de maturité et diagnostic d’écart (gap assessment)Confirmed · last used 1 to 3 years ago
• Gestion de la surface d’attaque externe (EASM) et de l’exposition : découverte d’actifs, priorisation, suivi du traitementConfirmed · used this year
• ISO/IEC 27001 : système de management de la sécurité de l’information (SMSI)Confirmed · last used 1 to 3 years ago
• ISO/IEC 27005 : analyse et gestion des risques de sécuritéConfirmed · last used 1 to 3 years ago
• Rédaction de politiques et de procédures de sécuritéConfirmed · last used 1 to 3 years ago
• Référentiels de contrôles de sécurité : CyberFundamentals (CyFun), ISO/IEC 27002, NIST CSFConfirmed · used this year
• Registre des risques, plans de traitement et appétence au risqueConfirmed · last used 1 to 3 years ago

Language requirements

• FrenchNative