Business Information Security Officer (BISO)

About the role

PwC Netherlands is looking for a Business Information Security Officer (BISO) to shape the firm’s security governance, risk and compliance in a rapidly evolving regulatory environment. You will lead the CISO office’s internal control, audit readiness and implementation of frameworks such as ISO 27001, SOC 2, NIS2 and DORA, while also driving AI governance and the annual security risk assessment.

Key responsibilities

• Act as subject‑matter lead on internal security, risk and control initiatives, translating global policy into practical standards for PwC NL.
• Work hands‑on with auditors, business stakeholders and technology teams to embed security into daily operations.
• Lead the internal control framework, prepare audit evidence, track remediation and improve control maturity.
• Implement, maintain and continuously improve ISO 27001, SOC 2, NIS2 and DORA compliance.
• Manage the firm’s internal IT Unified Control Framework and security awareness campaigns.
• Develop and oversee AI governance policies, risk assessments and responsible‑use controls.
• Report regularly to senior stakeholders on control status, audit findings, regulatory readiness and risk themes.

Required profile

• Proactive professional with a structured, consultative approach and hands‑on delivery mindset.
• 5+ years of experience in information security, IT governance, compliance, risk management and internal control.
• Hands‑on experience implementing and maintaining ISO 27001, SOC 2 and NIS2.
• Strong understanding of internal audit processes, control testing and issue remediation.
• Excellent communication skills with both technical teams and business stakeholders.

Required skills

• ISO 27001
• SOC 2
• NIS2
• DORA