Senior Consultant in Cyber & Digital Law

CMS Belgium; Brussel; Hybrid; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Hybrid working

Offices in Brussels and Antwerp

Certifications funded

Job summary

CMS Belgium is seeking a Senior Consultant to join its cyber and digital regulatory team in Brussels or Antwerp. You will be the calm, structured point of contact for clients in crisis, leading intake, coordinating forensic teams, and advising on GDPR, NIS2 Law, DORA and related obligations.

You will work alongside our lawyers, drafting notifications, supporting decision-making in extortion scenarios, and driving post-incident reviews to translate lessons into concrete improvements.

Qualifications

• Law degree (Master in Laws or equivalent) from an EU-based university.
• 3–5 years in data protection, cybersecurity, technology or digital regulation.
• Genuine interest in technology and threat landscape.
• Fluency in Dutch and English (French a strong plus).
• Ability to explain legal issues clearly to CISOs, IT teams and boards.
• Availability for standby rota.

Responsibilities

• Lead intake and scoping, run status meetings and liaise with cyber insurers.
• Coordinate forensic investigators, IT and security providers, insurers, brokers and crisis communications.
• Assess GDPR, NIS2, DORA and sectoral rules reporting obligations and deadlines.
• Draft notifications to DPA, sectoral supervisors and communications to data subjects and partners.
• Support decision-making in extortion scenarios and sanctions questions.
• Run post-incident reviews and implement concrete improvements.
• Advise on GDPR and Belgian data protection governance, DPIAs, transfers and vendor management.
• Scope NIS2, CyberFundamentals, DORA and Cyber Resilience Act compliance via gap analyses and roadmaps.
• Advise on AI Act, Data Act, Data Governance Act, DSA/DMA, eIDAS, cloud and outsourcing rules.
• Draft and negotiate DPAs, security schedules, SLAs and incident cooperation clauses.
• Build incident response plans, playbooks and tabletop exercises; train legal, IT and exec teams.
• Write guidance, speak at webinars and sector events; grow the practice and retainer offering.

Skills

Data protection

Cybersecurity

Technology understanding

Dutch and English fluency

Communication to CISOs/boards

Standby rota availability

Education

Law degree (EU university)

Tools

CIPP/E/CIPM/CISM/CISSP certifications

Job description

Brussels or Antwerp Hybrid No bar admission required

When a client is hit by ransomware at 2 a.m., someone has to bring order to the chaos. That means getting

forensics moving, mapping the reporting deadlines, briefing the board and handling the insurer. At CMS

Belgium, that someone could be you.

Our market-leading Technology, Media & Communications practice is looking for a Senior Consultant to join

its cyber and digital regulatory team. This role is for a legal professional who is as curious about how systems

get breached as about what the law requires afterwards. You will work alongside our lawyers, but you don’t

need to be at the bar. We welcome people from law firms, consultancies, in‑house legal or compliance teams,

regulators and public authorities.

One role, two sides

When an incident hits, you are the calm, structured point of contact for clients in crisis. You will:

• lead intake and scoping, run status meetings and act as the liaison with cyber insurers
• coordinate forensic investigators, IT and security providers, insurers, brokers and crisis communications
• assess reporting obligations under GDPR, the Belgian NIS2 Law, DORA and sectoral rules, and keep every deadline on track
• draft notifications to the DPA, the CCB and sectoral supervisors, as well as communications to data subjects, customers and partners
• support decision‑making in extortion scenarios, including the sanctions questions around payment
• run post‑incident reviews and turn the lessons into concrete improvements

Between incidents, you help clients get ready and stay compliant. You will:

• advise on GDPR and Belgian data protection: governance, DPIAs, international transfers, data subject rights and vendor management
• scope NIS2, CyberFundamentals, DORA and Cyber Resilience Act compliance through gap analyses and roadmaps
• advise on the AI Act, Data Act, Data Governance Act, DSA/DMA, eIDAS, and cloud and outsourcing rules
• draft and negotiate DPAs, security schedules, SLAs and incident cooperation clauses
• build incident response plans, playbooks and tabletop exercises, and train legal, IT and executive teams
• write guidance, speak at webinars and sector events, and help grow the practice and its retainer offering

Who you are

What we need:

• a law degree (Master in Laws or equivalent) from a EU‑based university
• at least 3–5 years in data protection, cybersecurity, technology or digital regulation
• a genuine interest in technology: you like understanding how things actually work and you follow the threat landscape
• fluency in Dutch and English (French is a strong plus)
• the ability to explain legal issues clearly to CISOs, IT teams and boards, and to stay composed and discreet under pressure
• availability for our standby rota [frequency / compensation]

What would make you stand out:

• hands‑on experience with breach or incident response
• familiarity with ISO/IEC 27001, CyberFundamentals or the NIST CSF
• certifications such as CIPP/E, CIPM, CISM or CISSP (we will support you in getting them anyway)
• experience in a regulated sector: finance, healthcare, energy, telecoms or critical infrastructure
• enough technical literacy to hold your own with a forensic team (no engineering degree needed)

Don’t tick every box? Apply anyway. We care more about curiosity and judgment than a perfect checklist.

What you get

• a senior, visible role with real ownership of matters and direct client contact from day one, and a clear path to a leading role in the cyber practice
• work where law, technology and crisis management meet, where no two incidents are the same
• the reach of the CMS network: 7,400+ lawyers in 50+ countries, cross‑border matters and secondment opportunities
• Competitive remuneration plus bonus, with an annual review
• a structured development path, with your certifications funded
• hybrid working and real flexibility, with offices in Brussels and Antwerp
• a collegial, non‑hierarchical team that takes the work seriously without taking itself too seriously
• international CMS events, trainings, well‑being programmes and sports activities

How it works

The process has three steps: an introductory conversation, an interview with the practice leadership including a short case discussion, and a final meeting with the team.