GRC Technical Expert (Senior) - Freelance

Start Date: ASAP
Workload: Part-time (3 days per week)
Location: Zaventem (Hybrid: Minimum 2 days on-site required)

Mission Context

We are seeking a Senior GRC Technical Expert to secure critical projects by identifying, analyzing, and mitigating IT and cyber risks from the design phase. The mission is to bridge the gap between complex technical architectures and Governance, Risk, and Compliance (GRC) requirements, ensuring all high-impact initiatives are resilient and compliant.

Scope of Work

• Portfolio: 100% of projects classified as "Critical" or "High Impact."

• Work Rhythm: Part-time (3 days/week).

• On-site Presence: Minimum of 2 days per week on-site to facilitate technical deep-dives and face-to-face stakeholder alignment.

• Impact: Direct influence on reducing the organization's cyber-exposure through proactive remediation tracking.

Key Responsibilities

• Technical Risk Decomposition: Deconstruct complex project architectures and data flows to identify underlying security vulnerabilities. This involves applying OWASP Risk Rating Methodology for application-level threats alongside ISO 27005 for systemic IT risks.

• Cross-Functional Collaboration: Partner with Architects and DevOps teams to integrate security controls without stalling delivery velocity.

• Compliance Oversight: Ensure strict adherence to internal security policies and mandatory regulations, including GDPR and NIS2, throughout the project lifecycle.

• Architecture Deep-Dives: Analyze software design (APIs, micro-services) to detect flaws such as those listed in the OWASP Top 10, ensuring security is baked into the design.

• Third-Party Security: Conduct security reviews of external contracts and technical assessments of critical service providers.

• On-site Stakeholder Engagement: Lead in-person workshops with Architects and Product Owners to translate regulatory requirements into technical controls.

• Reporting: Translate technical risks into clear, actionable business insights for management and steering committees.

Key Performance Indicators (KPIs)

• Assessment Coverage: Percentage of critical projects analyzed before the production "Go-Live."

• Remediation Rate: Percentage of high-risk findings successfully addressed or formally accepted by stakeholders.

• Risk Prediction Reliability: Zero major security vulnerabilities discovered in production that were not previously identified during the GRC assessment phase.

• Turnaround Time: Average duration between project intake and the finalization of the security risk report.