Technical Information Security Officer (T-ISO) & Incident Response Officer

At Grant Thornton, you work with colleagues who take cybersecurity seriously.

As part of our CISO Office, you help ensure that security policy does not remain theoretical. You translate requirements into implementable technical baselines, review architecture and changes, assess technical security risks and coordinate the security response during major incidents.

You combine strong technical expertise with governance, collaboration and practical judgement. You know how to challenge constructively, bring structure under pressure and turn complex security topics into clear decisions and actions.

What will you do?

As Technical Information Security Officer (T-ISO) & Incident Response Officer, you operate from the CISO Office as a senior second-line professional. You are the technical-security governance counterpart for Information & Automation (I&A). You provide requirements, oversight, advice and challenge, while I&A remains responsible for implementation, technical operation and delivery.

You will:

• Translate cybersecurity policies, controls and risk decisions into technical standards, baselines, acceptance criteria and practical guidance across domains such as identity, cloud, endpoint, network, platform security, secure change and hardening.
• Review security architecture, solution designs, technology choices, changes and releases for security-by-design, risk exposure and alignment with Grant Thornton’s security requirements.
• Provide independent second-line challenge and advice to I&A, architects, engineers and project teams, while maintaining a clear boundary between oversight and execution.
• Maintain a sharp distinction from I&A and engineering: you do not structurally implement, configure or operate technical controls; I&A remains accountable for technical delivery.
• Govern vulnerability, threat, logging, monitoring and detection activities by assessing coverage, prioritisation, remediation, exceptions, retesting, penetration-test planning, findings, remediation evidence and follow-up, and escalation of material risks.
• Coordinate the security response during major cyber incidents, including severity assessment, stakeholder coordination, evidence governance, timelines, decision logs, chain of custody, root-cause analysis, lessons learned and follow-up actions.
• Develop and maintain incident-response playbooks, severity models, tabletop exercises and improvement actions that strengthen Grant Thornton’s incident readiness.
• Report technical security exposure, incidents, remediation progress, exceptions and key risks to the CISO and relevant stakeholders in a clear and decision-oriented way.
• Ensure your work results in clear technical requirements, visible risk exposure, timely escalation, stronger incident readiness and evidence-based follow-up on remediation.

What do you bring?

You are a senior cybersecurity professional with strong technical depth and governance insight. You are structured, pragmatic and calm under pressure. You can explain complex risks clearly and influence decisions without taking over first-line ownership.

We expect:

• A bachelor’s or master’s degree in IT, cybersecurity, computer science or equivalent practical experience.
• Relevant experience in technical security, security governance, incident response, architecture review or vulnerability management.
• Solid knowledge of cloud, identity, endpoint, network, platform security, secure configuration, monitoring, detection and incident-response processes.
• Understanding of security frameworks and standards such as ISO 27001, NIST CSF or comparable frameworks.
• Strong communication skills in Dutch and English, both spoken and written.
• Willingness to be reachable outside regular business hours when required for material incidents or crisis situations.
• Security certifications such as CISSP, GIAC, GCIH, GCFA, OSCP or comparable certifications are a plus.
• Pre-employment screening, including a Certificate of Conduct (VOG), may be part of the process where required for this role.

About the team

You’ll join the CISO Office within Quality, Risk & Compliance. The team focuses on risk management, governance, compliance and oversight of information security. From this independent position, the CISO Office advises on risks, reviews measures and monitors compliance with security policy.

You will work closely with I&A, architects, project teams, risk specialists and other stakeholders, while maintaining the second-line independence needed to challenge, advise and escalate where necessary.

What You’ll Get

An international organization where you can grow into the professional you want to be, with an open culture, flexibility, and a healthy work-life balance.

• A strong balance between working, office collaboration, and personal time.
• A full-time position, with part-time options open for discussion.
• 29 vacation days, with the option to purchase additional leave.
• The flexibility to exchange three Christian public holidays for celebrations that better reflect your cultural or personal background.
• Social events with your team.
• A structured year-end bonus, paid in December.
• Access to the Grant Thornton Academy, where you can further develop your technical expertise and personal skills. From professional certifications to mindfulness and well-being programs, your growth is our priority.

Grant Thornton is a global network of independent assurance, tax, and advisory firms. In the Netherlands, we combine the benefits of a close-knit organization with an open culture and short communication lines, while offering international opportunities and multicultural experience.

We strive to provide a sustainable and supportive working environment where you can develop your expertise and make a meaningful impact.

• Location: Hybrid