Information Security Advisor (Governance Risk and Compliance)

About this role

Lead information security risk assessments for applications, infrastructure and third-party suppliers. Advise product owners and stakeholders on security controls, risk mitigation and compliance requirements. Review and improve information security policies, standards and control frameworks. Coordinate internal and external audit activities and support the timely resolution of findings. Evaluate security exceptions and monitor the effectiveness of implemented controls.

As an Information Security Advisor, you will be part of KPMG's IT Security Governance, Risk & Compliance (GRC) team. Together with colleagues across Technology, Risk, Privacy and Procurement, you help ensure that security is embedded in everything we do. You will advise on security risks related to both internally managed systems and externally sourced technology services. This includes conducting risk assessments, reviewing security controls, and helping teams implement improvements that align with KPMG's security standards and industry frameworks such as ISO 27001 and NIST.

A significant part of the role involves partnering with application owners, project teams and suppliers. You challenge where necessary, identify potential vulnerabilities, and help stakeholders make informed decisions that balance security, business objectives and regulatory requirements. You will also contribute to audit preparation and remediation activities, evaluate security exception requests, and support continuous improvement initiatives across the organisation.

This gives you a broad view of KPMG's technology landscape and the opportunity to influence how security is integrated into modern cloud, AI and digital services. In this role, you will combine technical understanding with strong stakeholder management skills, helping colleagues across the business navigate increasingly complex security and risk challenges Bachelor's or master's degree in Information Security, Cyber Security, IT, Risk Management or a related field.

Experience with information security frameworks such as ISO 27001, NIST or SOC 2. Experience conducting information security or IT risk assessments. Experience engaging with business stakeholders and translating security requirements into practical solutions. Strong command of English and Dutch, as you will work with local and international internal stakeholders, documentation and suppliers. Nice to have CISSP, CISM or CISA certification.