Basic-Fit is in a phase where digitalization, in-house software development, international growth, acquisitions, and new business models such as franchising are placing increasingly higher demands on the management of IT risks and information security.
Your Role
As IT & Security Risk Advisor, you strengthen the 2nd Line of Defense (2LOD) and help the organization further increase its security maturity. You are an independent advisor and sparring partner for DevOps teams, solution architects, IT management, Enterprise Architecture, and suppliers. You combine in-depth knowledge of cybersecurity and software development with a strong risk awareness and an independent 2LOD perspective. You know how to translate complex technical issues into clear risk assessments and pragmatic advice for both management and development teams. In this role, you get the opportunity to make a visible impact on the further professionalization of IT & Security within one of the largest fitness chains in Europe, in an international organization with an ambitious digital change agenda.
In this role, you report to the IT Quality Officer of Basic-Fit International.
You work within a broad network of stakeholders, including DevOps teams in Hoofddorp and Tilburg, responsible for business-critical digital platforms and applications used daily by millions of members and thousands of employees in six countries. In addition, you have regular contact with shared services teams, colleagues within the 2nd line, 1LOD officers, and external auditors.
Your tasks:
Developing, implementing, and further professionalizing the 2LOD security assurance process for software development, in which you challenge DevOps teams and solution architects on Security by Design, Secure SDLC, and the effectiveness of security measures.
Contributing to the further development of the IT Control Framework, security policy, and governance processes.
Identifying and realizing opportunities to further professionalize the 2LOD IT Security function through the smart use of AI, AI agents, and process automation, so that risk assessments, assurance activities, and management reporting can be carried out more efficiently and at scale.
Preparing management reports, risk analyses, and advisory documents for IT management, the Executive Board, and the Audit & Risk Committee.
Who are you?
We are looking for an experienced security professional who feels comfortable at both a technical and strategic level. You understand how modern software is developed and can substantively challenge development teams, without being responsible yourself for the execution or management of security measures.
If you are a strong technical security specialist but still developing in strategically advising and persuading executive management and senior stakeholders, we also invite you to apply.
You are independent, analytical, and persuasive. You know how to bring people along, dare to ask critical questions, and are able to pragmatically solve complex issues. You take ownership, independently determine the approach within agreed frameworks, and come up with well-founded solutions and advice for complex issues.
At least 5 years of relevant experience in cybersecurity, IT Risk, Security Architecture, or Security Assurance, or demonstrably equivalent working and thinking level.
Knowledge of Secure Software Development, Security by Design, and DevSecOps principles, with the ability to substantively challenge DevOps teams and critically assess security measures.
Experience with IT Risk Management, security governance, and assurance.
Knowledge of relevant frameworks such as ISO 27001, CIS Controls, and current legislation and regulations (including GDPR, NIS2).
Experience with modern software architectures, cloud platforms, and the associated security challenges.
Excellent communication skills and the ability to operate at all levels within the organization.
Excellent command of English, spoken and written, given Basic-Fit's…