An acquisition, and security needs to be assessed or merged.
In an acquisition the buyer wants to know what security risks it is taking on, and after the deal two environments, two sets of policies and two teams have to become one. That work comes on top of everything already running, with a deadline set by the deal. Within two days you'll have an experienced security specialist interviewed who leads the due diligence or the integration. If you need someone permanently, we recruit that person just as well, though not within two days.
The moment
Before the deal it's the buyer asking: what is the state of security at the company we're acquiring, which incidents have there been, which certifications and contractual obligations are we taking on, and what will it cost to bring that up to our level. After the deal the question shifts: two networks, two identity environments, two sets of policies and two teams each with their own habits have to become one, while the customers on both sides must notice nothing. In both cases there's a date that doesn't belong to security but to the deal, and your own people are already full with the regular work.
What's at stake for security in an acquisition
In due diligence it's about an honest picture in a short time: the state of the basic controls, the incident history, the dependence on suppliers, the obligations from customer contracts and legislation, and the risks that belong in the price or the warranties. In integration it's about order and pace: what has to merge first (identity, access, email, monitoring), what can wait, and what is better kept separate. Those who have done this before know where the surprises are; those doing it for the first time discover them after the deal. We're not lawyers or M&A advisers; we supply the security specialist who sits at the table next to them.
What needs to happen now
- The security due diligence. An assessment that fits within the deal timeline, with findings the negotiators can use. An interim CISO or IT risk manager with acquisition experience.
- Day-one arrangements. What has to be in place on the day of transfer: access, incident handling, who decides. Security architect with IT from both sides.
- Planning the integration. Identity and access, network, monitoring, policies; in an order that removes risks first and doesn't halt the business. Security architect or interim CISO.
- Execution. The hands that actually do the merging, alongside your own administrators. Security engineers, temporarily.
- Handover. A merged environment with one policy and one responsible person, and a handover to the team that stays.
Who leads this
In an acquisition organisations look for an interim CISO or IT risk manager for the due diligence and the direction, a security architect for the integration design, and security engineers for execution. Sometimes, if one of the two companies had no security lead, this is also the moment to recruit one for the first time. Which of those roles it is for you depends on the phase and the size; that's where the intake starts. If you need someone permanently, that's simply permanent recruitment; temporarily, it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy, not even under deal pressure. We start with a proper intake: which phase, which date, what's already known, who this person needs to bring along and what they may and may not know before the deal. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Confidentiality is arranged in the agreement, before the first name is mentioned. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
A due diligence or an integration programme is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. If it turns out after the integration that the merged organisation needs a permanent security lead, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
How fast can you provide someone when the deal is already running?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about the phase of the acquisition, the date and what the specialist may and may not know before the deal, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
How do you handle confidentiality around an acquisition?
We arrange that in the agreement before the first name is mentioned: confidentiality for the interim professional and for us, and agreements on what is and isn't shared with the other company. Many interim professionals in our network have worked under an NDA in an acquisition before and know the rules of the game.
What exactly does a security due diligence look at?
An honest picture in a short time: the state of the basic controls, the incident history, the dependence on suppliers and cloud, the certifications and the obligations from customer contracts and legislation, and the cost of bringing it up to the buyer's level. The outcome is a list of findings the negotiators can use in the price or the warranties. We're not lawyers or M&A advisers; the specialist sits at the table next to them.
Freelance, secondment or permanent: what suits an acquisition?
A due diligence or an integration programme is an assignment with a clear beginning and end, and then a freelancer with a model agreement fits well. If it turns out after the integration that the merged organisation needs a permanent security lead, we'll say so and recruit that person permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does an interim security specialist cost in an acquisition?
That depends on the person and the assignment, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment. The rate bands of who is currently available are listed anonymously with the interim professionals on this site.
What has to be in place on day one after the transfer?
At the very least who decides in an incident, how access between the two environments is arranged, and that monitoring and backups keep running on both sides. Everything after that, such as merging identity, network and policies, can follow in an order that doesn't halt the business. A security architect with acquisition experience makes that distinction in the first week.
We're the ones being acquired. Can you also help the selling side?
Yes. A seller whose security is in order and can show it keeps findings out of the price and the warranties. An interim security officer who prepares the file before the buyer's due diligence starts usually pays for itself.
Can this be done part-time?
Yes, the direction role and the due diligence in particular can often be done part-time. On a part-time assignment our margin per hour may be higher than on a full-time one; you see that up front, just like the rate.
Deal in sight, security not yet assessed?
Tell us which phase the acquisition is in and from when you need someone. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.