Cybersecurity Counsel

  • FIRST PRIVACY B.V., site Amsterdam
Cybersecurity Counsel, 1. image

FIRST PRIVACY B.V. invites you to apply for the position of Cybersecurity Counsel (NIS2 / DORA / ISO 27001/ Cyber Resilience) in Amsterdam.

If you are looking for an international experience, working with clients around the globe as well as colleagues from all over the world, we are happy to receive your application and get in touch with you.

Cyber and digital regulation is moving fast. NIS2, DORA, the Cyber Resilience Act together with standards such as ISO 27001 all ask organisations to turn legal obligations into concrete technical and organisational measures. We are looking for someone who can work on both sides of that line: someone who understands the controls and can explain what the law requires.

Your responsibilities

  • Translate NIS2, DORA, ISO 27001 and related requirements into concrete technical and organisational measures for multinational clients
  • Run certification readiness projects for ISO 27001 and the other schemes our clients' markets require, such as SOC 2, PCI DSS or the NHS DSPT: gap assessments, risk analyses, implementation, internal and mock audits, and coordination with the certifier
  • Map controls across frameworks so one evidence base serves several schemes, and assess sovereignty readiness for cloud and AI providers (EUCS and the proposed Cloud and AI Development Act)
  • Support incident handling where needed: first triage, log review and basic forensics, evidence preservation, port and vulnerability checks, breach analysis and incident notifications under GDPR, NIS2, DORA and the CRA.
  • Prepare clients for incidents: response plans and playbooks, reporting matrices with pre-drafted notifications, tabletop exercises and first responder training
  • Build and test business continuity and crisis management for clients: business impact analyses, continuity plans aligned with ISO 22301, crisis playbooks, crisis exercises and management training
  • Assess third-party and supply chain cyber risk, building on our processor due diligence work
  • Help technology providers and makers of connected products get ready for cyber regulations including NIS2, DORA, the CRA: scoping, maturity assessments, product security and vulnerability handling, customer questionnaires and contract clauses
  • Work together with our legal counsel to advise clients on the legal side of security compliance, including regulatory obligations, contracts and supply-chain requirements
  • Support our clients in finding creative and pragmatic solutions for the implementation of your advice
  • Work closely with clients from day one
  • Collaborate with an international team of counsels in complex projects
  • Help us build tech-enabled delivery: compliance platforms, AI-assisted drafting with human review, and self-assessment tools
  • Follow the evolving EU and national cyber and digital regulation landscape (NIS2 transpositions, DORA, CRA, Data Act, AI Act) and keep our clients ahead of it
  • Interact with supervisory and competent authorities and CSIRTs on behalf of our clients

Your profile

We are open to two backgrounds:

  • A master's degree in law (or equivalent) with hands-on information security experience, or
  • A degree or professional background in information security, IT or computer science with a strong interest in the legal side of compliance


In both cases we expect:

  • At least three years of full-time experience in information security or compliance, in consultancy environment
  • Hands-on work on NIS2 or ISO 27001 projects (gap assessments, implementation, audits or certification)
  • Working knowledge of DORA, the CRA and comparable frameworks (e.g. ISO 22301, ISO 27701, ISO 42001, NIST CSF, BSI IT-Grundschutz); certifications such as ISO 27001 or ISO 22301 Lead Implementer/Auditor, CISSP, CISM or CISA are a plus
  • Basic technical capabilities: data forensics, log analysis, port and vulnerability scanning, and comfort working with the relevant tooling
  • Practical experience with incident response and breach notifications; crisis management or crisis communications experience is a plus
  • A strong plus: experience with SOC 2, PCI DSS, the NHS DSPT, Cyber Essentials, business continuity or crisis exercises, product security and vulnerability handling, or negotiating security and DORA contract clauses
  • The ability to explain technical matters to lawyers and legal matters to engineers
  • Modern, inclusive and open-minded
  • Authentic
  • Good communicative skills
  • Ability and drive to work independently and to challenge yourself to a high-quality level
  • Good time management
  • Professional command of English and another language

We offer

  • Full-time position as Cybersecurity Counsel
  • The chance to be part of our vibrant, young and fast-growing team in Amsterdam
  • Flat hierarchies
  • Promotion of personal development through workshops, training, direct feedback
  • Healthy work-life balance
  • 30+ days vacation
  • Diversity, equality and inclusivity
  • Regular get-togethers and other events

 
We are committed to equal opportunities as well as non-discrimination, and aim to ensure equality in recruitment and employment.

FIRST PRIVACY B.V. 
Kantoor