Security & Compliance Specialist

AppTweak is ISO 27001 certified, and our customers increasingly expect clear, reliable answers on how we protect their data. Maintaining this level of trust is no longer a side activity: it requires dedicated ownership, rigour, and continuity throughout the year, not only in the weeks before an audit.

Today, compliance work and customer security questions are spread across the engineering team. ISO controls, policy updates and audit preparation compete with delivery priorities, and Deal Desk often has to escalate RFPs and security questionnaires to engineers for questions that are not development questions at all.

The Security & Compliance Specialist brings these two topics under one owner. Internally, they keep our ISMS alive and audit-ready: checks are done on time, policies are up to date, and evidence is available when needed. Externally, they become the go-to expert for Deal Desk on SLAs, data retention, backups, GDPR and related questions, so that customers get fast, consistent and accurate answers, and engineers can stay focused on building.

This is a part-time position (50%). It reports directly to the Head of Engineering, and works in close collaboration with Legal, notably on GDPR, data processing agreements and the contractual commitments we make to customers.

What You Will Do

ISO 27001 & ISMS Ownership

• Own the day-to-day running of our Information Security Management System (ISMS) and make sure it reflects how AppTweak actually works.

• Follow up on the ISO control plan: make sure recurring checks are performed by the right owners, on time, and that evidence is properly documented.

• Maintain the risk register, the Statement of Applicability, and track corrective actions and non-conformities until they are closed.

• Support the classification and follow-up of our suppliers, in line with our supplier tiering approach.

Policies & Documentation

• Maintain and regularly review our security and compliance policies (access control, backups, data retention, incident management, business continuity, etc.).

• Make sure policies are clear, accessible and known by the teams they apply to, not only written for the auditor.

• Keep a single, reliable source of truth for compliance documentation that other teams can easily consult.

Audit Preparation & Support

• Prepare internal and external audits: plan the timeline, gather evidence, and coordinate with the people involved.

• Be the main point of contact for auditors during the audit, and follow up on findings afterwards.

• Turn audit outcomes into concrete improvement actions, and make sure they are delivered.

Deal Desk & Customer Trust

• Act as the first line of support for Deal Desk on non-development technical questions: SLAs, data retention, backup policies, GDPR, hosting, access management and security practices.

• Help answer RFPs and security questionnaires, and only escalate to engineering the specific points that genuinely require it.

• Build and maintain a reusable knowledge base of approved answers, so Deal Desk can become more autonomous over time.

• Ensure what we commit to customers is consistent with our policies and what we actually do.

Cross-Team Collaboration

• Work closely with Engineering Managers, DevEx/infrastructure, HR, Legal and Deal Desk to embed compliance into existing processes rather than adding friction.

• Raise awareness of security and compliance topics across the company, and help onboard new joiners on the essentials.

Continuous Improvement & Strategic Projects

• Be proactive: challenge how things are done today and propose improvements to our security, compliance and Deal Desk processes, rather than only running them as they are.

• Drive strategic compliance projects end to end, such as building and maintaining our CAIQ (Consensus Assessments Initiative Questionnaire) so customer security assessments can be answered faster and more consistently.

• Hands-on experience with ISO 27001 (implementation, maintenance or audits), ideally in a SaaS or tech company.

• Good understanding of GDPR and of common customer security topics (SLAs, backups, data retention, access control).

• Comfortable talking with both engineers and sales: able to understand technical context and explain it in clear, simple language.

• Structured, rigorous, autonomous and proactive: you follow things through without needing to be chased, and you naturally suggest better ways of working.

• Fluent in English; French is a plus.

• A specialist profile: you do not need management experience, but you enjoy owning a topic end to end and can organise your work efficiently within a part-time (50%) schedule.

Don't tick every box? We'd still like to hear from you. We hire for potential and we'll help you grow.

AppTweak welcomes applicants of every gender, age, background and identity. If you need any adjustment during the hiring process, just let us know.

[Please note you will need a Belgian valid visa/work permit to be eligible for the role].

What Success Looks Like

After the first year, and within a half-time scope, ISO controls run on a predictable rhythm with no last-minute rush before audits, policies are up to date and known by the teams, audits close with few findings, Deal Desk answers most security and compliance questions without involving engineers, and our CAIQ is completed and kept up to date.

What's in it for you

• Join one of Belgium's top tech scale-ups.

• Competitive and optimized salary package, structured to make the most of what you earn.

• Meal vouchers and eco-vouchers.

• Complementary Health Insurance Plan. 

• 12 RTT days per year, on top of regular holidays.

• Flexible, hybrid work setup. 

• Opportunities for continuous learning and creative thinking.

• Quarterly team-building events and a yearly company-wide retreat.

• Serious about food. From themed lunches to spontaneous kitchen moments, food is genuinely part of how we connect at AppTweak. 🍴