Senior Social Engineering Specialist

ING HUBS SPAIN; Madrid; Hybrid; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Restaurant card.

Health insurance

Job summary

ING Hubs Spain is seeking a Senior Social Engineering Simulation Specialist to lead a global phishing and social engineering program within the CTM team. You will design credible scenarios, coordinate stakeholders and translate results into measurable improvements.

The role is hands-on, requires a risk-based approach, and fluency in English. You will collaborate with privacy, legal, HR and CISOs across multinational teams to strengthen resilience against threats.

Qualifications

• At least 5 years of relevant experience in cybersecurity, phishing simulation, social engineering testing, security awareness, threat-led testing or a comparable field.
• Hands-on experience managing and executing phishing simulation campaigns at scale using enterprise platforms.
• Strong knowledge of social engineering techniques and email technologies including sender authentication and reporting mechanisms.
• Experience translating threat intelligence into safe, realistic scenarios and analysing campaign data.

Responsibilities

• Manage the planning, governance, execution and continuous improvement of a risk-based global social engineering simulation programme, covering both global and targeted simulations.
• Own the full lifecycle of global and targeted phishing simulation campaigns, including scenario development, targeting, stakeholder coordination, technical preparation, quality assurance, scheduling, incident handling and reporting.
• Co-create realistic, threat-informed scenarios by translating relevant threat intelligence into safe and credible simulations.
• Develop simulations across channels beyond email, with clear objectives, approvals, boundaries and safeguards.
• Operate and continuously improve simulation platforms and supporting infrastructure, including templates, sending domains and data integrations.
• Define and analyse meaningful behavioural resilience metrics beyond click rates, including recognition, reporting and response behaviour.

Skills

Cybersecurity

Phishing simulation

Stakeholder management

Threat intelligence

English fluency

Tools

Phishing platforms

Job description

At ING Hubs Spain we are looking for a Senior Social Engineering Simulation Specialist Your role and work environment: We are looking for a talented and enthusiastic Senior Social Engineering Simulation Specialist to join our highly specialised and multicultural team within the Tribe Cyber Threat Management (CTM), part of the Global CISO Office. The responsibility of this team is to strengthen ING's resilience against current and emerging threats through a hands‑on approach, and our way of working is based on global collaboration, responsible testing, knowledge sharing and the Orange Behaviours. In this role, you will manage and execute ING’s global social engineering simulation programme, including the global phishing simulation programme. Your mission will be to safely test and improve how employees, teams and business processes recognise, report and respond to social engineering threats. This is not a traditional security awareness or communications role. We are looking for a hands‑on specialist who can run a global programme, develop credible scenarios, operate simulation technology, coordinate stakeholders, analyse behavioural data and turn results into measurable improvements without creating a culture of blame.

Your key responsibilities

• Manage the planning, governance, execution and continuous improvement of a risk-based global social engineering simulation programme, covering both global and targeted simulations.
• Own the full lifecycle of global and targeted phishing simulation campaigns, including scenario development, targeting, stakeholder coordination, technical preparation, quality assurance, scheduling, incident handling and reporting.
• Co-create realistic, threat-informed scenarios by translating relevant threat intelligence and observed attack patterns into safe and credible simulations.
• Develop, where appropriate, simulations across channels beyond email, such as telephone, messaging, collaboration tools, QR codes or physical approaches, with clear objectives, approvals, boundaries and safeguards.
• Operate and continuously improve simulation platforms and supporting infrastructure, including templates, sending domains, landing pages, reporting mechanisms, user targeting and data integrations.
• Ensure deliverability and technical performance, troubleshoot operational issues, and protect simulation systems and data from misuse.
• Define and analyse meaningful behavioural resilience metrics that go beyond click rates, including recognition, reporting and response behaviour.
• Identify trends across countries, business units, roles, channels and scenario types, and develop dashboards that highlight exposure and opportunities for improvement.
• Translate simulation outcomes into clear recommendations for security awareness teams, local CISOs, business leaders and control owners.
• Support targeted communications, learning activities, process changes, technical controls and follow-up simulations, assessing whether interventions improve resilience over time.
• Coordinate planning and approvals with privacy, legal, compliance, human resources, communications, technology and local CISO organisations.
• Ensure simulations account for local legal, labour, cultural, accessibility and employee well-being considerations, and present balanced and actionable insights to leadership.

What are we looking for?

Want to know if this job is made for you? These are some of the qualities that we value the most for this role.

• At least 5 years of relevant experience in cybersecurity, phishing simulation, social engineering testing, security awareness, threat-led testing or a comparable field.
• Demonstrable hands‑on experience managing and executing phishing simulation campaigns at scale using enterprise phishing simulation or human‑risk management platforms.
• Strong knowledge of social engineering techniques and email technologies, including sender authentication, mail routing, secure email gateways, URL protection, browser controls and reporting mechanisms.
• Experience translating threat intelligence into safe, realistic scenarios and analysing campaign data to produce meaningful risk insights and recommendations.
• Strong programme management and stakeholder engagement skills, with an understanding of the privacy, ethical, cultural and employee‑relations considerations associated with simulations in a regulated, multinational environment.
• A strong sense of ownership, with the ability to manage multiple activities, resolve operational issues, coordinate dependencies and follow through from planning to measurable improvement.
• A collaborative and constructive approach focused on helping employees and teams become more resilient rather than assigning blame.
• A continuous‑improvement mindset and the ability to stay ahead of the evolving social engineering threat landscape.
• Strong written and verbal communication skills and fluency in English.
• Experience with additional simulation channels, behavioural change, data analysis, automation or scripting is a plus.

What do we offer?

The time you spend at work, the challenges you face or the lessons you get are very important, but… What about your personal life? At ING we want your work to fulfil you in every way, and that is why we take care of even the smallest details. Check out what is waiting for you! Be flexible my friend. Our model is all about flexibility and accountability. Keeping both our customers and our colleagues needs in mind, you determine together which days you work at home and which you come to ING MAD to offer your best self. Do your thing.

• Restaurant card.
• Health insurance. For you and all your family (