A cloud migration that needs securing, and the team doesn't have the hands for it.
The cloud migration is scheduled, the vendor and the project team are in place, and then it turns out nobody is designing and setting up the security of the new environment: identity, network, logging, the guardrails that stop every engineer from making their own rules. Within two days you'll have an experienced cloud security engineer or architect interviewed who takes that on for the duration of the project and leaves it with the team. If you need someone permanently, we recruit that person just as well, though not within two days.
The moment
The business case is approved, the migration partner is chosen, the first workloads are scheduled for next quarter. In the steering committee "security" is a line in the plan, with the IT manager's name behind it. Then comes the first real question: who designs the landing zone, who decides how identity and access work in the new environment, who makes sure logging and detection are there from day one and not afterwards. The migration partner is happy to do it, but then it's assessing its own work. And your own administrators know the data centre, not the platform. That's the moment someone from outside makes the difference for the duration of the project.
What's at stake for security in a cloud migration
In the cloud, security lives in the setup: how accounts and subscriptions are divided, which rights identities get, how the network is segmented, what is encrypted and logged by default, and which rules automatically prevent someone from opening a storage bucket to the whole world. That work comes before the migration, not after; whoever does it afterwards migrates twice. At the same time responsibility shifts: the provider secures the platform, you secure everything you put on it. A cloud security architect who has done this before puts the guardrails in place within which the project team can work fast without security having to approve every change.
What needs to happen now
- Target architecture and guardrails. How the environment is divided, which rules apply automatically, what's forbidden and how that's enforced. The cloud security architect, before the first workload.
- Identity and access. Roles, rights, administrator accounts, integration with the existing directory, MFA everywhere. An IAM engineer or the cloud security engineer, together with the administrators.
- Logging, detection and backup. What gets logged, where it goes, who looks at it, and whether the backups can be restored. Cloud security engineer, with the SOC or the administrators.
- Review per migration wave. Holding every workload that moves against the guardrails, recording and resolving deviations. Cloud security engineer in the project team.
- Handover to the team. Documentation, runbooks and a few sessions with the administrators, so the setup is maintained after the project instead of slowly eroding.
Who leads this
Organisations here look for a cloud security architect for the design and the guardrails, a cloud security engineer who works in the project team and builds the setup, and sometimes an IAM engineer if identity is the biggest piece. The platform (Azure, AWS, Google Cloud) determines who fits; that's where the intake starts. If you need someone permanently, say a cloud security engineer who stays after the migration, that's simply permanent recruitment; for the duration of the project it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: which platform, which schedule, who the migration partner is, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
Securing a migration is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. If it turns out after the migration that the environment structurally needs a cloud security engineer, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
How fast can you provide a cloud security engineer?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about the platform, the schedule and the migration partner, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
Can't the migration partner just take care of security?
It can, and often does part of it. But then it's assessing its own work, and the guardrails within which it may build should be yours, not theirs. Your own cloud security architect, even temporarily, puts those frameworks in place and holds every migration wave against them. That saves the discussion afterwards about who was responsible.
Freelance, secondment or permanent: what suits a migration?
Securing a migration is an assignment with a clear beginning and end, and then a freelancer with a model agreement fits well. If it turns out after the migration that the environment structurally needs a cloud security engineer, we'll say so and recruit that person permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does an interim cloud security engineer cost?
That depends on the person, the platform and the assignment, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment. The rate bands of who is currently available are listed anonymously with the interim professionals on this site.
Azure, AWS or Google Cloud: does that matter for who you propose?
Yes. The principles are the same, the setup isn't, and an engineer who has worked in Azure for years isn't automatically fast in AWS. Tell us at the intake which platform and which services you use; we only propose people who have demonstrably worked with them.
When should the security specialist join: before or during the migration?
Before the first workload, if at all possible. The division of the environment, identity and access and the automatic rules determine how everything is built afterwards; whoever adjusts that later migrates twice. If you're already in the middle of the project, now is the second-best moment.
What does the interim professional leave behind when the project is done?
A configured environment with documentation and runbooks, and administrators who know how the guardrails work and why. That last part matters most: a cloud setup nobody understands erodes within a year. We agree the handover in advance as part of the assignment.
Can this be done part-time?
The architect role often can, the engineer in the project team usually can't, certainly not during the migration waves. On a part-time assignment our margin per hour may be higher than on a full-time one; you see that up front, just like the rate.
Migration planned, security not yet assigned?
Tell us which platform you're going to and when the first workloads have to move. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.