Cybersecurity Counsel

Datenschutz cert; Amsterdam; On-site; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Vibrant team in Amsterdam

Flat hierarchies

Professional development through培训 and

Healthy work-life balance

30+ days vacation

Diversity and inclusivity

Job summary

FIRST PRIVACY B.V. invites applications for the position of Cybersecurity Counsel (NIS2 / DORA / ISO 27001/ Cyber Resilience) in Amsterdam.

The role focuses on translating regulatory requirements into concrete technical and organizational measures for multinational clients and coordinating certification readiness projects across schemes such as ISO 27001, SOC 2, PCI DSS, and NHS DSPT. You will map controls across frameworks, support incident handling, and help clients prepare for incidents with

Qualifications

• At least three years of full-time information security or compliance experience.
• Hands-on work on NIS2 or ISO 27001 projects.
• Knowledge of DORA, the CRA and related frameworks (ISO 22301, ISO 27701, ISO 42001, NIST CSF).
• Ability to explain technical matters to lawyers and to engineers.

Responsibilities

• Translate NIS2, DORA, ISO 27001 and related requirements into concrete measures for multinational clients.
• Run certification readiness projects for ISO 27001 and other schemes (SOC 2, PCI DSS, NHS DSPT): gap assessments, risk analyses, implementation, audits, and coordination with certifiers.
• Map controls across frameworks to create a single evidence base for multiple schemes.
• Support incident handling: triage, log review, forensics basics, evidence preservation, breach analysis and notifications under GDPR, NIS2, DORA, CRA.
• Prepare clients for incidents: response plans, notification matrices, tabletop exercises and first responder training.
• Build and test business continuity and crisis management: BIA, ISO 22301-aligned plans, crisis playbooks and drills.
• Assess third-party cyber risk and supplier due diligence.
• Assist technology providers with regulatory readiness: scoping, maturity assessments, product security and contractual clauses.
• Collaborate with legal to advise on obligations, contracts and supply-chain requirements.
• Engage with clients from day one and work with an international team of counsels.
• Contribute to tech-enabled delivery: compliance platforms, AI-assisted drafting, self-assessment tools.
• Monitor EU/national cyber regulation developments and inform clients.

Skills

Information security

Regulatory compliance

English proficiency

Communication skills

Education

Master's degree in law

Degree in information security/IT/computer science

Job description

FIRST PRIVACY B.V. invites you to apply for the position of Cybersecurity Counsel (NIS2 / DORA / ISO 27001/ Cyber Resilience) in Amsterdam.

If you are looking for an international experience, working with clients around the globe as well as colleagues from all over the world, we are happy to receive your application and get in touch with you.

Cyber and digital regulation is moving fast. NIS2, DORA, the Cyber Resilience Act together with standards such as ISO 27001 all ask organisations to turn legal obligations into concrete technical and organisational measures. We are looking for someone who can work on both sides of that line: someone who understands the controls and can explain what the law requires.

Your responsibilities

• Translate NIS2, DORA, ISO 27001 and related requirements into concrete technical and organisational measures for multinational clients
• Run certification readiness projects for ISO 27001 and the other schemes our clients' markets require, such as SOC 2, PCI DSS or the NHS DSPT: gap assessments, risk analyses, implementation, internal and mock audits, and coordination with the certifier
• Map controls across frameworks so one evidence base serves several schemes, and assess sovereignty readiness for cloud and AI providers (EUCS and the proposed Cloud and AI Development Act)
• Support incident handling where needed: first triage, log review and basic forensics, evidence preservation, port and vulnerability checks, breach analysis and incident notifications under GDPR, NIS2, DORA and the CRA.
• Prepare clients for incidents: response plans and playbooks, reporting matrices with pre-drafted notifications, tabletop exercises and first responder training
• Build and test business continuity and crisis management for clients: business impact analyses, continuity plans aligned with ISO 22301, crisis playbooks, crisis exercises and management training
• Assess third-party and supply chain cyber risk, building on our processor due diligence work
• Help technology providers and makers of connected products get ready for cyber regulations including NIS2, DORA, the CRA: scoping, maturity assessments, product security and vulnerability handling, customer questionnaires and contract clauses
• Work together with our legal counsel to advise clients on the legal side of security compliance, including regulatory obligations, contracts and supply-chain requirements
• Support our clients in finding creative and pragmatic solutions for the implementation of your advice
• Work closely with clients from day one
• Collaborate with an international team of counsels in complex projects
• Help us build tech-enabled delivery: compliance platforms, AI-assisted drafting with human review, and self-assessment tools
• Follow the evolving EU and national cyber and digital regulation landscape (NIS2 transpositions, DORA, CRA, Data Act, AI Act) and keep our clients ahead of it
• Interact with supervisory and competent authorities and CSIRTs on behalf of our clients

Your profile

We are open to two backgrounds:

• A master's degree in law (or equivalent) with hands-on information security experience, or
• A degree or professional background in information security, IT or computer science with a strong interest in the legal side of compliance

In both cases we expect:

• At least three years of full-time experience in information security or compliance, in consultancy environment
• Hands-on work on NIS2 or ISO 27001 projects (gap assessments, implementation, audits or certification)
• Working knowledge of DORA, the CRA and comparable frameworks (e.g. ISO 22301, ISO 27701, ISO 42001, NIST CSF, BSI IT-Grundschutz); certifications such as ISO 27001 or ISO 22301 Lead Implementer/Auditor, CISSP, CISM or CISA are a plus
• Basic technical capabilities: data forensics, log analysis, port and vulnerability scanning, and comfort working with the relevant tooling
• Practical experience with incident response and breach notifications; crisis management or crisis communications experience is a plus
• A strong plus: experience with SOC 2, PCI DSS, the NHS DSPT, Cyber Essentials, business continuity or crisis exercises, product security and vulnerability handling, or negotiating security and DORA contract clauses
• The ability to explain technical matters to lawyers and legal matters to engineers
• Modern, inclusive and open-minded
• Authentic
• Good communicative skills
• Ability and drive to work independently and to challenge yourself to a high-quality level
• Good time management
• Professional command of English and another language

We offer

• Full-time position as Cybersecurity Counsel
• The chance to be part of our vibrant, young and fast-growing team in Amsterdam
• Flat hierarchies
• Promotion of personal development through workshops, training, direct feedback
• Healthy work-life balance
• 30+ days vacation
• Diversity, equality and inclusivity
• Regular get-togethers and other events

We are committed to equal opportunities as well as non-discrimination, and aim to ensure equality in recruitment and employment.