A network security project: segmentation, firewall migration or zero trust.
The flat network in which one infected laptop can reach everything, the firewall going out of support at the end of the year, the insurer or the pentester asking for segmentation, or the ambition to move to zero trust without anyone knowing where to start. These are projects with a hard end date and a high risk of disruption, and your own network administrators have their hands full with the day job. Within two days you'll have an experienced network security engineer or architect interviewed who designs and executes it, alongside your own team. If you need someone permanently, we recruit that person just as well, though not within two days.
The moment
Sometimes it's the pentester showing they could reach the finance systems from the printer. Sometimes the insurer making segmentation a condition. Sometimes the vendor announcing the firewalls go out of support in eight months, or management having read about "zero trust" and wanting to know when it will be there. In all cases there's a network that has grown the way networks grow, with rules nobody dares to clean up anymore, and an operations team that keeps it running but has no room for a project that takes months and where one mistake halts production. That's the moment for someone from outside who has done this before, for the duration of the project.
What's at stake in such projects
Segmentation and firewall migrations are not configuration work but design work: which systems have to talk to each other, which never, and how you introduce that without an application nobody knew about going down. Zero trust goes a step further, because identity and device state determine what's allowed, and that touches every workplace and every application. Those who have done this before start with insight into what really runs over the network, introduce it in small steps with a way back, and document it so the operations team can maintain it after the project. Those who try it in one weekend make the news on Monday morning.
What needs to happen now
- Visibility of the traffic. What talks to what, which dependencies exist that nobody knows about. The engineer, with measurement data, in the first weeks.
- Design of zones and rules. Which segments, which rules between them, which exceptions may be temporary. The architect or senior engineer, with the administrators and the application owners.
- Introducing in steps. First measure, then block, segment by segment, with a way back per step. The engineer alongside the operations team, outside peak hours.
- Firewall migration or zero-trust building blocks. Cleaning up and transferring rules, or linking identity and device state to access. The engineer, with the vendor where needed.
- Handover. Documentation, a rule management process the team actually follows, and a few sessions so the knowledge stays in-house.
Who leads this
Organisations here look for a network security engineer who designs and executes, a security architect if it's part of a bigger change such as zero trust or a cloud migration, and a firewall engineer with experience on the specific platform for a migration. Which of those roles it is for you depends on the equipment and the size; that's where the intake starts. If you need someone permanently, say a network security engineer who stays after the project, that's simply permanent recruitment; for the project it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: which equipment, which schedule, what the trigger is, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
A segmentation or migration project is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. If it turns out after the project that the network structurally needs a security engineer, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
How fast can you provide a network security engineer?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about the equipment, the schedule and the trigger, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
Does it matter which firewall or network platform we have?
Yes, certainly for a migration: someone who has built on one platform for years isn't automatically fast on another. For design work such as segmentation and zero trust, what counts most is experience introducing it without disruption. Tell us at the intake which equipment is in place and we'll propose people who have demonstrably worked with it.
How do we prevent production from halting during segmentation?
By first measuring what really runs over the network, then blocking in small steps with a way back per step, and working outside peak hours. An engineer who has done this before plans it that way and involves the application owners before closing anything. Those who try it in one weekend make the news.
Freelance, secondment or permanent: what suits a network project?
A segmentation or migration project is an assignment with a clear beginning and end, and then a freelancer with a model agreement fits well. If it turns out after the project that the network structurally needs a security engineer, we'll say so and recruit that person permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does an interim network security engineer cost?
That depends on the person, the platform and the assignment, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment. The rate bands of who is currently available are listed anonymously with the interim professionals on this site.
Is zero trust something for an organisation of our size?
Zero trust isn't a product but a direction: access based on identity and device state instead of network location. Every organisation can take steps in it, and the first steps (MFA, device checks, segmenting what matters most) are often already worthwhile. An architect who has done this before says honestly which steps fit you and which are overkill.
The pentester reached our finance systems from a printer. Is segmentation the answer?
Usually a large part of it. Segmentation ensures an infected device can't reach everything, and that is exactly the path pentesters and attackers use. Combine it with access management and detection and you have the three things that make the difference at the next test and in a real attack.
Can this be done part-time?
The design often can, the implementation usually can't, certainly not in the phases where segments are being closed. On a part-time assignment our margin per hour may be higher than on a full-time one; you see that up front, just like the rate.
Network project planned, too few hands?
Tell us what needs to happen, with which equipment and by when. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.