Business Information Security Officer

• As a Business Information Security Officer (BISO), you advise departments regarding Cybersecurity issues.
• You will be working in the Cybersecurity team of Enterprise Technology within the Governance & Security team.
• We are going for it: Schiphol must belong to the top 3 of European airports.

As a Business Information Security Officer, you provide support to product teams by providing advice on technical and governance issues arising from the implementation of measures, architecture designs, and the identification of vulnerabilities. How exactly you realize this? That is up to you. We trust in the way you can work with concentration and attention. You apply your talents to:

• performing risk, threat, and vulnerability analyses on IT services, as well as identifying security and design gaps within existing and new architectures and solutions.
• advising product teams and architecture on appropriate cybersecurity measures and solution directions, including coordination with the cyber architect.
• implementing and improving technical security measures, including hardening at OS and middleware level and supervising firewall changes.
• supporting and coordinating security incidents in collaboration with SOC/SIEM and relevant stakeholders.
• drafting and (having) implemented solutions for identified cybersecurity findings and outstanding risks.
• ensuring cybersecurity requirements from laws, regulations, and standards (such as ISO 27001 and PCI) within the lifecycle of IT services
  actively contributing to IT projects as a security representative, including performing security reviews and risk assessments.
• preparing and assessing audits (internal and external), including vendor assessments on security standards.
• continuously improving cybersecurity processes and collaborating with stakeholders, according to the PDCA cycle.

Information security within Schiphol is organized according to the usual "three lines model". The BISO is part of the 1st line:

1st line: Owner and responsible for managing information security risks. The product teams are responsible for taking adequate measures, both technically and procedurally, for the systems they implement and manage.
2nd line: The central Schiphol Cyber Security Center is responsible for maintaining the Information Security Management System (CSMS) 3rd line: Independent monitoring through internal or external audits of the policy and its execution.

You ensure that compliance with the cyber security policy is visible and clearly communicated. In addition to helping prevent cyber security incidents, the Business Information Security Officer has an important advisory and monitoring role in managing all IT risks that could negatively affect the business continuity of Enterprise Technology.

Enterprise Technology is the department in which all generic IT is brought together. The department provides standardized building blocks - such as infrastructure, platform services, connectivity, and digital workplace services - which are used by the Business Platforms for the development and management of their domain-specific solutions. Enterprise Technology thus functions as a technological foundation within Digital & Technology and enables the Business Platforms to focus on value creation for their business domain.

Schiphol connects your world. With the best people, we make travel safe and responsible. You contribute to this with your unique talents, such as the way you have sincere attention for others, take their needs seriously, and connect people to achieve the ultimate result. In any case, for this position you have:

• HBO working and thinking level.
• a CISSP certificate (is a requirement).
• experience with Cyber Governance in a large stakeholder field.
• experience with Operational Technology (OT) infrastructure. IEC 62443 certification is a plus.
• knowledge of Identity and Access Management and Incident Response is a plus.

Extensive Cybersecurity engineering knowledge of topics such as:
• Windows and Linux operating systems (embedded)
• Encryption and application security technologies.- Networks• Cybersecurity testing methodologies
• Middleware
• Hardening (including CIS, OWASP) or SOC/SIEM

Good is good enough

• You know when something is good enough to move forward. You guard the balance between quality and progress, make substantiated choices, and prevent perfection from slowing down speed or impact. You stimulate your team to work pragmatically, to learn in the process, and to continuously improve together.
• You work with full end‑to‑end ownership: you tackle issues from start to finish, maintain an overview of the entire process, and ensure that results actually land in the organization. You guard the coherence between strategy, execution, and impact and take responsibility until it truly works for the business.
• You dare to actively challenge the business and teams, ask critical questions, and stimulate different ways of thinking. You bring a clear vision, combine ambition with execution power, and know how to not only initiate but also actually realize change. You stimulate movement, break patterns, and ensure that improvements truly land in the organization.

Appreciation: Scale 13

What are your talents? What are your dreams? What is your story? We are curious about you and would like to invite you to apply. You can apply by sharing your motivation and CV with us via the application button below.

• Do you have questions about the content of the position? Contact Mechiel Aalbers, Manager Governance & Security via mechiel.aalbers@schiphol.nl.
• Do you have questions about the application process? Direct these to Lars Jongkind, Recruitment Business Partner, via lars.jongkind@schiphol.nl.