[Hiring] Head of Security & Compliance @Luzmo

Role Description

Luzmo is creating an independent role: a Head of Security & Compliance who sets our security and data protection policy, checks that we follow it, and tells us clearly when we don't.

You will be our CISO and our Data Protection Officer (DPO). To ensure independence, you will report to our Board of Directors, not to the CTO or the founders. Your responsibilities include:

• Setting security and data protection policies and standards.
• Keeping the risk register up to date and agreeing on priorities with management.
• Checking that controls work in practice, including reviewing cloud and infrastructure configuration.
• Running periodic access reviews and managing pentests and follow-up findings.
• Acting as our Data Protection Officer, advising on GDPR compliance and being the contact point for the Belgian Data Protection Authority.
• Answering security questionnaires and advising on security and data protection parts of client contracts.
• Reviewing designs of new features for security and privacy before they are built.
• Owning the incident response process and coordinating responses to security incidents.
• Organizing security awareness training and secure coding training for engineers.
• Reporting regularly to the Board of Directors on risks, compliance, and the progress of the security program.

This is a part-time role (60%), as an employee (preferred) or freelancer, from our Leuven office or remote within EU time zones.

Qualifications

• 5+ years of experience in security, with at least 2 years owning security and/or compliance at a software company.
• A technical background (e.g., engineer, DevOps/SRE, security engineer, or pentester).
• Experience running a SOC2 Type II audit.
• Practical knowledge of GDPR, including DPAs, subprocessors, international data transfers, DPIAs, and breach notifications.
• Experience with public cloud security (AWS, GCP, or Azure).
• Experience with security questionnaires, client contract reviews, and security incidents.
• Fluent in English, written and spoken, and based in an EU time zone.

Requirements

• You can read code and cloud configuration, not only policies.
• You give independent advice, even when it is not what people want to hear.
• You can explain security clearly to engineers, sales, clients, and the board.

Benefits

• Full ownership of security and data protection at Luzmo, with a direct line to the Board.
• Real independence with documented advice and legal protection as DPO.
• Your own budget for tools, audits, pentests, external advice, and training.
• An exciting scale-up environment with growth opportunities.
• Competitive salary (or day rate if you work as a freelancer).
• Flexible holiday policy, remote working, and international get-togethers.
• The equipment, software, and tech you need to do your job.

Nice to have

• Experience with ISO 27001, NIS2, DORA, or the EU AI Act.
• Interest in AI security: LLM data flows, prompt injection, MCP/agent access control.
• Experience at a scale-up of 50–200 people.
• Certifications like CISSP, CISM, CCSP, OSCP, or CIPP/E.
• Knowledge of Dutch or French.