Your CISO or security officer is leaving, and the chair can't stay empty.

The moment

It starts with a conversation you hadn't planned: your CISO has another job, or the security officer who keeps everything in his head is out for months. The notice period is a month, two at most, and finding a good successor in this market takes four months rather than four weeks. In the meantime the ISO surveillance audit is scheduled, a major customer sends its annual questionnaire, the accountant wants to know who reviewed the access rights, and a phishing email arrives that someone has to handle. Nobody in the organisation wants to take on that chair on the side, and rightly so.

What has to keep running in the meantime

A security function has a rhythm that doesn't wait for a vacancy. The risk analysis and the register of controls have to be maintained, or you'll lose them at the next audit. Incidents have to be assessed and, where required, reported within the statutory deadline. Suppliers and customers keep asking questions. Projects that need security input stall or, worse, carry on without it. And the board expects someone who can say where the organisation stands. An interim professional who has done this before takes over that rhythm in the first week, without you having to organise a three-month onboarding.

What needs to happen now

1. Handover before the departure. What's where, which agreements are running, which passwords and access rights need to move. If the departing colleague is still there, this is the week to do it, with the interim professional present.
2. The running obligations in a list. Audits, certifications, reporting duties, contractual commitments to customers. The interim professional draws up that list in the first days and puts dates next to it.
3. Deciding what waits and what doesn't. Not everything has to continue; some projects can pause for a quarter. That's a conversation between the interim professional and management.
4. Finding the successor. An interim professional who runs the role knows after a few weeks exactly what the profile of the permanent successor should be. That saves a failed recruitment.
5. Handing over to the successor. A good interim professional leaves the role better than they found it, with a handover document the successor actually uses.

Who leads this

For the CISO role organisations look for an interim CISO who can face the board, the regulator and the customers; for the operational role an interim security officer or ISO who keeps the management system running; and sometimes a security manager who leads the team until there's a new manager. Which of those roles it is for you depends on who is leaving and what that person really did; that's where the intake starts, and it often turns out to differ from the job title. The permanent successor is simply permanent recruitment; the bridge is interim. We've been doing both for years, preferably in one move.

Interim: within two days, and what it costs

Fast doesn't mean sloppy. We start with a proper intake: who is leaving, what that person really did, what's running, who the interim professional needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.

Freelance, and the Dutch DBA Act

Bridging a role until the successor arrives is an assignment with a clear end, and an experienced interim CISO decides how to do that work. Still, we look more closely here than with a project: someone who works in the line for months, sits with the management team and leads the team is close to a job. At the intake we assess that honestly and define the assignment so that the Dutch tax authority, which has resumed enforcement on false self-employment since 2025, recognises an assignment in it: result, own approach, no line of authority. If it is in fact a job, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.