Filling NIS2 Roles: Translating Duties into Search Profiles

AI This article was created with the help of AI.

Which protection tasks have already been assigned?

Before a new job title is created, a sober assessment of the current situation is needed: Which of the statutory protection tasks does your facility already fulfil today, and who specifically bears them? Section 30 of the German Federal Office for Information Security Act (BSIG) obliges particularly important and important facilities to take appropriate, proportionate and effective measures, compliance with which must be documented. The law specifies ten areas of measures, ranging from risk management to multi-factor authentication. Exactly this list is your starting point, not the job market.

• Risk analysis and IT security concepts

• Handling of security incidents (incident response)

• Business continuity: backup management, disaster recovery, crisis management

• Supply chain security, including provider relationships

• Security in the acquisition, development and maintenance of ICT systems, including vulnerability management

• Assessment of the effectiveness of risk management measures

• Training and awareness-raising measures

• Concepts and processes for cryptographic procedures

• Personnel security, access control and asset management

• Multi-factor authentication, secure communication and emergency communication

The ten points are taken literally from Section 30, Paragraph 2 of the BSIG and are also described by the BSI as the minimum scope of risk management. For each task, you record in a simple mapping table: Who bears it today, in which role or organizational unit, and where is it documented? Many areas turn out to be already covered during this audit, such as backup management in IT operations or access concepts in the identity team. These findings are more valuable than any job advertisement because they show you which competence is actually missing.

Two contextualizations help to manage expectations. Firstly: You never derive whether you are affected solely from the industry. By 30 June 2026, a total of 17,729 facilities had registered in the BSI portal, of which 11,501 were important and 6,215 were particularly important, and each facility checks for itself whether it is affected, for example via the BSI's applicability tool. Secondly: No job title automatically creates compliance. A position with NIS2 in the title does not fulfill a single one of the ten measures if the tasks, proof and responsibilities are not clearly assigned. The search profile arises from the task list, not the other way around.

Which competency gap justifies a new role?

You derive the required level of competence from the open tasks, not the other way around. The question is not: Which title do we advertise? But rather: Which of the ten areas of measures are vacant, and which profile can demonstrably cover them? There is a European reference for this translation: ENISA has mapped the NIS2 duties to the role profiles of the European Cybersecurity Skills Framework (ECSF), the EU reference framework for cybersecurity skills.

1. Compare open tasks from your mapping table with the 12 ECSF role profiles and note the appropriate profile for each task.

2. Combine profiles instead of inventing titles: The ENISA guide maps NIS2 obligations to ECSF profiles and contains practical application scenarios for using the profiles.

3. Check internal further training options before the position is advertised: Who in the team is already performing parts of the task and can fully cover the profile with targeted training?

The market makes this trade-off urgent. According to ENISA NIS Investments 2024, 89 percent of the organizations surveyed expect to need additional Cybersecurity staff to meet NIS2, while 32 percent of organizations and 59 percent of SMEs are unable to fill open security roles at all. Anyone advertising generic titles in this market is competing with everyone else for the same profiles. On the other hand, anyone who offers a precisely defined bundle of tasks appeals to exactly those candidates who measure their impact by results rather than titles. And sometimes the answer is not a new hire at all, but an internal profile that is specifically qualified for the open tasks.

Which tasks belong in the same search profile?

Not every gap turns into its own job. GRC, technical implementation and operational response are three different types of work, and bundling them unchecked in one person is the most common mistake made in NIS2 hiring. A proven first role boundary for medium-sized companies: The role of Cybersecurity Manager is filled internally, incident response, threat intelligence and forensics are outsourced to specialized providers, audits and pentests are purchased externally. This division is a good initial orientation for your own role boundaries.

• Draw role boundaries along reporting deadlines: Significant security incidents must be reported to the BSI within 24 hours of becoming aware of them as an early initial report, within 72 hours as a follow-up report and after one month as a final report. This cascade needs an established reporting chain with cover, not just a position on the organizational chart.

• Keep non-delegable responsibility with the facility: Even if a service provider submits the report on behalf of the facility, responsibility for the incident and the content of the report remains with the facility.

• Write interfaces into the profile: The role needs defined handovers to management, IT operations and external service providers, otherwise a second isolated security silo is created.

In practical terms, this means that you first decide which tasks will be filled internally and which will be purchased, and only then do you write the search profile. An internal role that is to lead incident response needs proven experience in incident handling and reporting processes. A role that is only supposed to buy in and effectively evaluate audits and pentests, on the other hand, needs competence in tendering, control and effectiveness evaluation. Both are legitimate, but they are two different profiles, and the job advertisement must be able to differentiate.

Which proof does the technical interview verify?

In the technical interview, it is the proof of work that decides, not the buzzword bingo. Instead of asking for the third certificate, you test three things: implemented controls, proof created and documented collaboration. Anyone who claims to have set up risk management should be able to describe which measure from Section 30 BSIG that was, how compliance was documented and who evaluated the effectiveness. It is precisely this proof that the law requires, and it is precisely by this that you measure whether competence has been claimed or put into practice.

• Implemented controls: Which of the ten areas of measures did the person actually set up or develop further, and in which role?

• Proof created: What documentation, effectiveness assessments or reports did the person create themselves or have professional responsibility for?

• Collaboration: How did the person work with executive management, IT operations and external service providers, and how were decisions documented?

One point deserves particular clarity: Section 38 of the BSIG assigns the implementation and monitoring of risk management measures to executive management; in the event of a breach of duty, they are liable to the facility in accordance with corporate law rules, and they must regularly take part in training. This responsibility cannot be delegated, not even to a CISO or security manager. In the technical interview, you should therefore clarify the boundary of responsibility with management: Where does the professional implementation of the role end, where does the management's duty of supervision begin, and how are decisions between the two documented? Candidates who can clearly describe this boundary themselves are a strong quality signal.

How does a NIS2-related search mandate take shape?

This completes your search mandate: a defined task package from the open areas of measures, the named interfaces to management, operations and service providers, and the expected proof for the technical interview. This is precisely the package you hand over to the recruitment consultancy instead of approving a job advertisement with NIS2 in the title. With Festanstellung (Permanent Recruitment) from Nova Search, you discuss the defined NIS2 search profile directly during the briefing: The first qualified profiles land on your desk within 5 working days, checked via a two-stage screening process consisting of a deep technical review and culture interview, with a 90-day guarantee if a placed person leaves the company again. 5 days instead of 5 months, and no CV noise.