Information Security Officer

• A role with real impact in an organization that takes security seriously

• Collaboration with specialized external partners (Nerium, Intercept)

• Room to further professionalize the security program

• Hybrid working from Utrecht

Bloxs Software is a growing software developer in the real estate sector. We build and deliver cloud-based SaaS solutions for the Dutch market, running entirely on Azure. Our organization grows via a buy-and-build strategy, which means we regularly integrate new companies and teams into our environment.

Information security is not just a checkbox for us - it is a foundation for our service to customers.

As an Information Security Officer, you are the pivot between policy and practice. You translate compliance requirements into workable processes and you keep daily security practices sharp. You work closely with our external security partners - Nerium (MDR/SOC) and Intercept (Cloud Control) - and you are the internal point of contact for everything related to information security.

This is a combined operational and tactical role: you set frameworks, but you also follow up. You know how to articulate complex topics clearly - towards management, colleagues, and external partners - and you understand how AI applications are changing security practices.

• Managing and keeping up to date the ISMS and the associated policy documents (ISO 27001-oriented)

• Coordinating the annual ISAE 3402 Type II audit: collecting evidence, alignment with the auditor, follow-up of findings

• Monitoring compliance with AVG/GDPR, including the Processing Register and data processing agreements

• Performing and following up on risk assessments and periodic policy evaluations

• Monitoring compliance with the EU AI Act for our product AI applications (invoice recognition, payment matching, chatbots)

• First point of contact for security incidents and escalations from Nerium (MDR)

• Monitoring the monthly control cycle (MCC) and following up on findings such as patch status, access management, and capacity alerts

• Managing access rights and reviews in Azure Entra ID

• Collaborating with Intercept Cloud Control for patch management and quarterly reports

• Managing vendor assessments and contractual security requirements (including Freshworks, HoorayHR, external AI providers)

• Onboarding new companies into the Bloxs security environment during acquisitions

• Participating in quarterly meetings with Nerium and annual strategic discussions

• Organizing and guiding security and AI awareness within the organization

• Communicating clearly about risks, policy, and measures - from technical teams to management

• Advising management on risks, investments, and security strategy

• Drafting and maintaining procedures for onboarding, offboarding, and change management