Information Security & Compliance Manager

• HBO or WO working and thinking level, preferably in computer science, cybersecurity, business administration, or a similar field.

• Experience with information security governance, risk management, and compliance.

• Knowledge of ISO 27001 and preferably of EASA Part-IS, NIS2, CER, and GDPR.

• Experience with risk analyses, policy development, and maintaining an ISMS.

• Experience with internal or external audits and the follow-up of findings.

• Good communication skills and experience with stakeholder management.

• Knowledge of IT general controls, CIS Controls, and assurance reports is a plus.

• Experience with ITIL processes and tools such as Jira, TOPdesk, or ServiceNow is a bonus.

• A certification such as CISM, CISSP, CRISC, ISO 27001 Lead Implementer/Lead Auditor, or CIPP/E is a plus.

At Corendon, we take good care of our people. You can count on:

• 30 vacation days (full-time) and the possibility to buy or sell days.

• Use of our IPB scheme: flying affordably with Corendon for you, your partner, children, and an introduction.

• Attractive discounts on holidays, hotels, and car rentals. With our holiday discount scheme, you can quickly receive up to €1,000 discount on your holiday annually.

• Full public transport reimbursement or travel allowance when traveling by car.

• A pension scheme via BeFrank.

• A free continuous travel insurance with worldwide coverage.

• Fun sports activities and parties via our Corendon sports and social committee.

• A varied job in an ambitious, international organization with short lines of communication and an informal atmosphere.

As Information Security & Compliance Manager, you will direct the further development of information security and digital resilience within Corendon. You will take a leading role in developing, implementing, and maintaining the information security policy and the Information Security Management System (ISMS). In doing so, you will translate laws and regulations, standards, and contractual obligations into clear and workable measures.

You will identify and assess information security risks regarding systems, projects, processes, organizational changes, and suppliers. Together with the relevant colleagues, you will determine appropriate control measures and monitor their timely and effective execution. You will also play an important role in the assessment and follow-up of information security incidents and vulnerabilities.

Additionally, you will coordinate and supervise internal and external audits. You will monitor the follow-up of findings and improvement measures and test whether the measures taken are actually effective. With clear indicators, dashboards, and management reports, you will provide management, the board of directors, and the board with insight into the current state of information security and digital resilience.

You will actively contribute to a strong security culture within Corendon. To this end, you will develop and organize targeted awareness activities and training, and help colleagues make information security part of their daily work.

• You develop, implement, and maintain the information security policy and the ISMS.

• You translate, among other things, ISO 27001, EASA Part-IS, Cbw/NIS2, Wwke/CER, and GDPR into practical measures.

• You perform information security risk analyses for systems, projects, processes, and organizational changes.

• You assess and monitor information security risks regarding suppliers and other external parties.

• You support the assessment, control, and follow-up of incidents and vulnerabilities.

• You monitor the security and resilience baseline and the associated control measures.

• You coordinate internal audits and assess external audits and assurance reports.

• You monitor the timely and effective follow-up of findings and improvement measures.

• You develop indicators, dashboards, and reports for management, the board of directors, and the board.

• You follow relevant developments, new threats, and changes in laws and regulations.

• You organize training and awareness activities.

• You advise, both requested and unsolicited, on information security, risks, and compliance.

We are looking for a substantively strong professional who collaborates easily with different disciplines and organizational levels. You can assess risks well, ask the right questions, and translate complex requirements into clear and actionable measures.

You are analytical, independent, and stand firm in your shoes. You dare to name risks and shortcomings, but keep an eye on operational and commercial practice while doing so.