Interim IT Security Officer (freelance)

We are Skytree Skytree enables a transition to a world with cleaner Air for everyone. We do this by developing and deploying smart technology that captures atmospheric carbon dioxide, enabling its use or storage to combat climate change and aid society and businesses around the world. Born out of the European Space Agency (ESA), we are a global team of highly talented scientists, engineers and business professionals, supported by an experienced management team. Our working culture is based on a dynamic and smart approach to business with an open and understanding attitude to others and a desire to expand the boundaries of what is possible. Your role Skytree runs an integrated management system for ISO 9001 and ISO/IEC 27001. We are looking for a freelance information security and compliance professional to keep our information security management system (ISMS) running and audit-ready while a colleague is temporarily unavailable. This is a freelance (ZZP) assignment of 1 day a week for 6 months, with the option to extend. You will own the ISO 27001 side of our management system: keep controls and evidence up to date in Vanta, close open corrective actions, tighten how we manage access across our business systems, and work alongside our Quality Manager on internal audits and the next external audit. You’ll make an impact by - ISMS ownership: act as information security lead and point of contact for ISO 27001, internally and towards our certification body. Maintain controls, evidence and the risk register in Vanta, and keep the Statement of Applicability current. Advise Management and HR on these matters. - Risk management: run the information security risk process and deliver a dated, management-approved risk assessment report. - Corrective actions and audits: drive open corrective actions from internal and external audits to closure with evidence, co-run the internal audit programme with our Quality Manager, and prepare for and attend the next external audit. - Policies: update and roll out our information security policies, including physical security for our Amsterdam office and Almere site, information classification, acceptable use, access control, change management and business continuity. - Access governance: map admin rights across our business systems, set up backup admins and account recovery that don't depend on one person, run periodic access reviews, and make sure leavers' accounts are closed in every tool. - Suppliers and software: keep a register of SaaS tools and licences with owners, set the approval route for new software and AI tools, and assess the security side of supplier changes such as network and firewall updates. - Awareness and continuity: run security awareness activities and business continuity tabletop exercises, and record and follow up security incidents with our IT team.