Outsourced Roles.
Not every organisation needs a full-time CISO. But every organisation handling sensitive data, pursuing certification, or operating in a regulated industry needs that expertise — on demand, accountable, and embedded in your business.
Senior Security Expertise, Without the Full-Time Cost
Finding a qualified CISO with ISO27001 lead auditor credentials and TISAX experience who wants to work for a 300-person automotive supplier in Central Europe is genuinely difficult. And even if you find one, the salary is €120,000–€180,000 for a function that might need 2 days of senior attention per week.
ITIS-Secure provides qualified, certified security professionals on a fractional basis. They attend your management reviews, run your audit programme, manage your ISMS, report to your board, and interface with certification bodies — as a full member of your team, not a remote adviser who sends monthly reports.
You get a verifiable credential (their certifications are real, their experience is documented), continuity (the same person, not a revolving door of consultants), and flexibility (scale up before a certification audit, scale back during quiet periods). Our outsourced professionals are engaged through ITIS-Secure and are fully accountable to the terms of your engagement agreement.
Roles We Provide
Qualified, certified security professionals for every function your compliance programme requires.
Cybersecurity Manager (CISO)
Own the information security programme. ISMS management, risk oversight, board reporting, certification management, incident response leadership, and stakeholder communications. Your CISO, on demand.
SMEs and mid-market companies that need executive-level security leadership without a full-time C-suite hire.
Data Privacy Officer (DPO)
Fulfil the statutory DPO function under GDPR Article 37. Advising on data protection obligations, conducting DPIAs, managing data subject requests, liaising with supervisory authorities, and maintaining records of processing activities. Organisations required to appoint a DPO under Article 37 must ensure the external DPO meets the independence requirements of Article 38.
Any organisation processing personal data at scale or handling special category data — particularly under GDPR Article 37(1).
Cybersecurity Architect
Design and oversee your security architecture. Network segmentation, zero-trust implementation, cloud security controls, and technical control frameworks. Ensures your technical environment is built to certification standard from the ground up.
Project-based or part-time retainerCompanies building new infrastructure or undergoing digital transformation alongside compliance programmes.
Internal Auditor
Design and execute your internal audit programme. Conducting structured audits against ISO27001, TISAX, or NIS2, writing formal audit reports, managing nonconformities, and maintaining the evidence trail certification bodies require.
Quarterly audit cycles or annual programmeCompanies under ISO27001 surveillance audits, or TISAX recertification cycles.
Risk Management Specialist
Own your risk management process. Conducting risk assessments, maintaining the risk register, developing risk treatment plans, and ensuring risk management meets the requirements of your certification framework.
Quarterly reviews or project-basedOrganisations whose risk assessment is a certification requirement (ISO27001 Clause 6, TISAX).
ISMS Manager
Day-to-day management of your Information Security Management System. Control monitoring, document management, evidence collection, supplier oversight, awareness programme coordination, and management review preparation.
1–4 days/month retainerCompanies post-certification who need someone to maintain the ISMS without a full-time resource.
AIMS Manager
Specialized management of your Artificial Intelligence Management System (ISO42001). Oversight of AI risk assessments, data quality for training sets, algorithmic transparency, and ethical governance of autonomous components.
2–6 days/month retainerOrganisations operating complex AI models or autonomous systems that require ongoing ISO42001 compliance and risk oversight.
Compliance Officer
Monitor and manage regulatory compliance across your applicable frameworks. Tracking regulatory changes, ensuring controls remain current, managing compliance registers, and interfacing with legal and regulatory bodies.
Part-time retainer or project-basedRegulated industries (financial services, healthcare, defence) where the compliance landscape evolves frequently.
Who Is This For?
"We need a CISO for certification"
Company pursuing ISO27001 or TISAX that needs an accountable security owner but doesn't want to hire full-time for a 12-month project.
"We lost our security manager"
Organisation mid-certification or under surveillance whose security lead has left. Needs continuity immediately — not a 3-month recruitment process.
"We're required to have a DPO"
Company that falls under GDPR Article 37 DPO obligation but isn't large enough to justify a full-time data protection officer.
"Our auditor wants to see an audit programme"
Company under ISO27001 surveillance or TISAX recertification that needs a credible internal audit conducted by a qualified auditor — not their own IT manager reviewing their own work.
Why Outsource vs. Hire?
| Full-Time Hire | ITIS-Secure Outsourced Role | |
|---|---|---|
| Annual cost | €80K–€180K | €15K–€60K (scope-dependent) |
| Availability | 5 days/week | Agreed days — typically 10–12/month |
| Time to start | 3–6 months | 2–4 weeks |
| Certifications | Variable | Verified, current |
| Risk if they leave | Critical | Continuity guaranteed |
| Framework depth | Depends on hire | Specialist expertise |
Cost ranges are indicative. Exact engagement costs depend on role, scope, and days required. Contact us for a proposal.
How the Engagement Works
From initial scoping to ongoing delivery, every engagement is structured for accountability and results.
Requirements Scoping
We agree the role, responsibilities, required days per month, reporting lines, and deliverables.
Professional Matching
We match you with the right specialist — the person whose certifications, industry experience, and personality fit your organisation.
Onboarding
Your specialist embeds with your team — attends management reviews, interfaces with stakeholders, and begins delivering from week one.
Ongoing Delivery
Monthly delivery reports, quarterly performance reviews, and full flexibility to scale engagement up or down as your needs change.
Frequently Asked Questions
