Your first security lead, because a customer or investor is asking.
A scale-up or growing company that handled security "on the side" until a major customer sends a security questionnaire, an investor asks for policies during due diligence or an insurer sets requirements. Then, for the first time, someone has to be responsible. Within two days you'll have an experienced vCISO or security officer interviewed who sets up the programme; if you want someone permanent right away, we recruit that person just as well, though not within two days.
The moment
Until now it went fine without. The CTO kept an eye on the cloud settings, a developer handled the pentest findings on the side, and MFA was on "almost everywhere". Then comes the moment someone from outside asks who's responsible: an enterprise customer sending a forty-page security questionnaire before signing, an investor asking for a security policy and an incident plan during due diligence, a cyber insurer wanting to see MFA and backups, or a first ISO 27001 or SOC 2 requirement in a tender. Suddenly security is no longer technical hygiene but a commercial condition, and there's nobody whose name is on it.
What a first security lead does
Not everything at once, and that's exactly the point. The first months are about the foundation: a picture of the risks that really matter, a few policies the team actually follows, access and backups in order, an incident plan that is one page long and works, and answers to customers' and investors' questions that are correct and faster to give each time. After that comes the choice of whether to work towards a certification, and how much security you want to have in-house structurally. An experienced vCISO has done this at several growth companies and knows which steps belong in which order, and what is overkill at your size.
What needs to happen now
- Answering whoever is asking. The customer's questionnaire, the file for the investor, the insurer's requirements: the acute first, with someone who has answered this kind of question before.
- Risks and the basics in order. Access, MFA, backups, logging, suppliers; the things every questionnaire and every insurer puts first.
- Policies that fit a company of your size. Not a corporate binder, but agreements the team understands and follows.
- A plan for the year after. Certification yes or no, which role is structurally needed, and what the interim professional leaves behind for the first permanent security officer.
- Filling the permanent role. Once the programme is in place, the next step is often an own security officer or engineer; the vCISO then knows exactly which profile.
Who leads this
Growth companies here usually look for a vCISO or part-time CISO who sets up the programme and faces the board and the customers, a first security officer who does the execution, or a security engineer if technology is the biggest gap. Which of those roles it is for you depends on who's asking and what's already in place; that's where the intake starts. If you want someone permanent right away, that's simply permanent recruitment; temporarily, it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: who's asking, what's already in place, how big the team is, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment; for a part-time vCISO, which it usually is, the margin per hour may be higher, and you see that up front too. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
Setting up a security programme at a company that doesn't have one yet is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, and a part-time vCISO for several companies at once is a textbook example. If the role becomes a full-time job in the line after the foundation, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
What is a vCISO and when is that enough?
A vCISO is an experienced CISO who works for you a fixed number of days per week or per month, often for several companies at once. For a growing company without its own security function that's usually enough to lay the foundation, face customers and investors and determine which role is structurally needed afterwards. Once security becomes a daily operation, an own security officer is the next step.
How fast can you provide someone?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about who's asking and what's already in place, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
A customer sent a forty-page security questionnaire. Can someone fill it in?
Yes, and preferably someone who has done it before, because the first questionnaire is the slowest. A vCISO or security officer answers it together with you, records the answers so the next questionnaire takes days instead of weeks, and immediately sees where the real gaps are. That last part is often worth more than the completed form.
Freelance, secondment or permanent: what suits a first security lead?
Laying the foundation is an assignment with a clear beginning and end, and a part-time vCISO for several companies is a textbook example of a freelance construction with a model agreement. If the role then becomes a full-time job in the line, we'll say so and recruit permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does a vCISO cost?
That depends on the person and the number of days, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment; for a part-time role the margin per hour may be higher. You see that up front, just like the rate.
Should we go for ISO 27001 or SOC 2 right away?
Not necessarily. Whether a certification is needed depends on who's asking and how often. A vCISO first lays the foundation and then says honestly whether a certification is the next logical step, or whether a well-completed questionnaire and demonstrable basic measures suffice for now. If it does become a certification programme, also see our page on ISO 27001.
How do we know which permanent role we need afterwards?
That's one of the things the interim professional leaves behind: a picture of how much security work there is structurally and which profile fits it. Often that's a security officer or a security engineer, rarely a full-time CISO straight away. We then recruit that permanent role in the same move, with the vCISO in the interviews.
Do you also work for small companies?
Yes, as long as security is the core of the work you're looking for. Growth companies with twenty to two hundred people are exactly the organisations where a first security lead makes the difference. However small, we start with an intake and say honestly what fits your size.
Someone for security for the first time?
Tell us who's asking and from when. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.