Security Specialist

We’re looking for a technical security specialist to join our SURF Vendor Compliance team. Are you passionate about cybersecurity, and does helping with complex security decisions energize you? Would you like to work for a great organization and support your colleagues with complex privacy and security processes and supply chain risk management? Do you also enjoy variety and are you eager to get to know SURF? Then this is the job for you!

Where you will work

SURF is the ICT cooperative for Dutch educational and research institutions. Together with them, we work on digital services and complex innovation challenges to enhance the quality of education and research.

Working at SURF means working for a unique and open organization. This is evident in everything: the structure of the organization, the setup of the project teams, the culture in our offices, and the atmosphere among colleagues. SURF offers excellent terms of employment and a flexible approach to work/life balance. Employees enjoy working independently. In addition, everyone is given the space and freedom to use and develop their talents as effectively and broadly as possible.

The team you will join

The Procurement & Delivery unit handles joint procurement, establishes compliance agreements, and provides IT services to SURF members. A key component of this work involves agreements on privacy and secure data processing, which are managed by the SURF Vendor Compliance team. We conduct privacy and security risk analyses on various vendors that are widely used in the education and research sectors. We also establish agreements with vendors, monitor compliance, provide information, and support SURF members in their compliance processes. Examples of our work can be found on our Vendor Compliance website.

The SURF Vendor Compliance (SVC) team has recently grown into a great team of 10 people. The team is characterized by a great deal of enthusiasm, energy, and professionalism. Having fun is an important part of what we do, and we incorporate this into the team events we organize at least once every quarter. We foster personal growth through participation in courses and (international) conferences. These conferences often serve as great opportunities for team building as well.

What you will do

As a security specialist, you evaluate the information security level of external suppliers and ensure that they comply with recognized security standards and legal requirements. You combine technical expertise with a strong commitment to (internal) stakeholders, identify risks, and advise the education sector on the secure implementation and use of applications.

Other responsibilities include:

• You conduct security assessments of suppliers and classify the risks;
• You evaluate suppliers’ information security levels based on recognized security standards, certifications, and audit reports (e.g., ISO 27001, SOC 2) and determine appropriate risk mitigation measures;
• You will support audits, privacy assessments, Data Protection Impact Assessments (DPIAs), and compliance activities by providing supporting evidence;
• You will advise and communicate with stakeholders in the education sector regarding security risks, assessment results, and risk mitigation measures;
• You will provide technical advice on privacy and security assessments, including supplier compliance.

Your skills and experience

• At least a higher professional education (HBO) level of work and thinking;
• Strong organizational and communication skills and an excellent command of Dutch and English, both spoken and written;
• You have experience in the field of information security, IT risk management, or IT compliance, as well as in conducting and evaluating security assessments and risk analyses at suppliers;
• The ability to evaluate and interpret audit reports, security certificates, and supporting documentation;
• Possession of relevant security certifications such as ISO 27001, CISA, CRISC, or equivalent certifications is a plus.

Prior to starting this job, a VOG must be presented.

SURF takes pleasure in doing its recruitment itself; acquisition is therefore not appreciated.