Freelance Information Security Officer (ISO)

Who we are

At OpenUp, our mission is to make mental well-being accessible to everyone. Following a ‘high tech & high touch’ approach, we support companies, their employees, and their families with proactive and practical mental health services. Through our digital platform, clients can access 1:1 check-ins, online courses, articles, videos, group sessions, mindfulness practices, and a team of committed mental well-being experts. As we believe that mental and physical well-being are deeply connected, we have also added Lifestyle Experts to our offering, focusing on nutrition, exercise, and sleep. We offer a truly holistic approach that helps people take ownership of their health. We’re proud to work with forward-thinking organizations and are committed to raising the bar on accessible care.

OpenUp was ranked in the Top 3 on LinkedIn’s Top Startups list for 2023, 2024 & 2025 and is continuously growing. We are expanding our international teams and we are searching for like-minded talent. We are already serving 2000+ companies (e.g. Rituals, Deloitte, Decathlon, KPMG, and McDonalds), through which 600K+ employees have access to our product.

The role

• ISMS ownership: own ISO/IEC 27001:2022 and NEN 7510:2024 end to end, the policy set, Statement of Applicability, risk register and the annual revision cycle.
• Audit & certification: prepare for and steer internal and external audits, and drive corrective actions to closure.
• Enterprise security assurance: own security due-diligence questionnaires (DDQs), vendor assessments and the security sections of enterprise RFPs, for new deals and renewals.
• Cloud security governance: govern our Azure posture (Defender for Cloud, vulnerability management, logging, private networking) and turn gaps into a prioritised action list for engineering and hold remediation SLAs. You govern and review; Platform Engineering builds.
• AI governance: build and own our AI governance framework, and review AI features (AI coach, AI-assisted session notes) for data protection, consent, human oversight and model risk.
• AI assurance readiness: lead ISO/IEC 42001 and EU AI Act readiness.
• Incident & continuity: oversee incident management, the data-breach protocol, and business-continuity / disaster-recovery testing.
• Risk management: mature our risk process toward ISO 31000 alignment.

What you'll bring (must-have)

• 6+ years in information security, with hands-on ownership of an ISO/IEC 27001 ISMS through external audits, not just participation.
• A track record of owning enterprise security due-diligence / DDQs.
• Enough Azure cloud-security knowledge (Defender for Cloud, Entra ID, Key Vault, networking, managed identities) to govern and challenge architecture. You do not need to be a cloud engineer, but you cannot be a paperwork-only compliance officer either.
• Strong policy-writing, and the ability to translate controls into practical engineering actions.
• Excellent written and asynchronous communication, and real comfort in a distributed, cross-cultural team.
• Pragmatic, outcome-oriented and comfortable with ambiguity.
• ISO/IEC 27001 Lead Auditor or Lead Implementer certification.

A strong plus (differentiators)

• Familiarity with AI/LLM systems and AI governance frameworks (ISO/IEC 42001, EU AI Act, NIST AI RMF, ISO/IEC 23894). 
• NEN 7510 or other healthcare / high-sensitivity data experience.
• CISSP, CISM or CIPP/E; AI-governance training such as AIGP.
• Secure-development background (OWASP, SAST/SCA, supply-chain hardening).

Next steps

Excited about this role at OpenUp? We love to learn more about you. Send us your application through our website and we will be in touch with you soon. 

At OpenUp, everyone is welcome to apply - regardless of color, age, gender, nationality or any other label. Our hiring decisions are based on indiscriminate objective measures. We embrace what makes you unique and we believe that a diverse team is crucial to success. If you are ready to OpenUp, join us!