Context

As part of strengthening its cybersecurity governance and achieving compliance with various regulatory and normative requirements, STIB is seeking a Security Compliance Consultant.

The consultant will participate in the cybersecurity program to build, maintain, and evolve the compliance framework to meet the requirements of several regulatory and normative frameworks, including:

• NIS2
• PCI DSS
• Cyber Resilience Act (CRA)
• Any other regulatory or normative requirement applicable to the organization

The assignment is mainly focused on the construction of the compliance framework, formalizing requirements, and defining controls. The consultant will not be responsible for the operational execution of the controls, which will remain the responsibility of the relevant business and IT teams.

The consultant will be responsible for translating regulatory, normative, and cybersecurity requirements into a coherent, measurable, auditable, and sustainable compliance framework.

As such, they will ensure the definition and maintenance of control frameworks, assessment methodologies, evidence requirements, and associated reporting mechanisms.

Main responsibilities

Construction and maintenance of control frameworks

• Analyze applicable regulatory and normative requirements.
• Translate these requirements into concrete and measurable controls.
• Build and maintain control frameworks associated with:
• NIS2
• PCI DSS
• CRA
• other applicable regulatory frameworks.
• Define for each control:
• the objective;
• evaluation criteria;
• evidence requirements;
• roles and responsibilities;
• monitoring indicators;
• the expected maturity level.

Compliance governance

• Maintain traceability between:
• regulatory requirements;
• cybersecurity risks;
• controls;
• remediation plans;
• evidence items.
• Define governance mechanisms enabling compliance monitoring.
• Participate in defining monitoring and escalation processes.