Senior Security Consultant

Job description

Context

This assignment is part of a framework agreement for the period 2022-2027, managed by a vendor-neutral Managed Service Provider. The role is based at a government tax administration office located in the Ellipsgebouw. The position involves working full-time (100%) with an estimated total of 800 hours. Remote work is possible.

Missions

• Perform risk analyses

• Develop guidelines related to information security

• Design and optimize information security processes

• Monitor and report on compliance aspects of information security

• Support security architects regarding legal requirements and risk analyses

Tools & Environment

• Experience as a Security Consultant in environments such as data, infrastructure, and applications

• Expertise in specific information security domains, including:

  • Implementing information security management processes

  • Conducting vulnerability analyses and penetration tests

  • Optimizing application security with cost-effective measures

  • Implementing Privileged Access Management

  • Implementing encryption solutions

• Knowledge and experience with security management techniques and frameworks such as ISO27000 series, COBIT for Security, NIST, OWASP, CIS Critical Security Controls for Effective Cyber Defense

• Familiarity with Secure Controls Framework and ISO27002

• Knowledge of NIS2 directive

• Experience in drafting policy documents and processes

• Conducting risk analyses according to ISO27005 standard

• Knowledge of Factor Analysis for Information Risk (FAIR) method

• Knowledge of the Mitre ATT&CK framework

• Relevant certifications depending on expertise domain (e.g., CISM, CISSP, CEH)

• Language requirement: Dutch at European CEFR level C2

Working Conditions

• Contract type: Framework contract 2022 - 2027 (Lot 1)

• Location: Government tax administration office, Ellipsgebouw

• Start date: 01/12/2026

• End date: 31/05/2027

• Work regime: 100% (full-time)

• Remote work: Allowed

Additional Information

• No personal data processing by the contractor is required

• Communication and contract management are handled by the Managed Service Provider

• Direct contact with the end customer is not allowed before candidate interview invitation

• Acceptance of the general terms and conditions is implied by responding to the request

• Verification of the right to represent candidates is mandatory to avoid double representation

Requirements

1. Proven experience as a Security Consultant in one of the following environments: data, infrastructure, applications
2. Expertise in a specific domain of information security (e.g., implementing information security management processes, performing vulnerability analyses and penetration tests, optimizing application security with cost-effective means, implementing Privileged Access Management, implementing encryption solutions)
3. Experience in analyzing, optimizing, and documenting security processes and governance
4. Experience with security management techniques and/or frameworks (e.g., ISO27000 series, COBIT for Security, NIST, OWASP, CIS Critical Security Controls for Effective Cyber Defense)
5. Knowledge and experience supported by certifications depending on domain of expertise (e.g., CISM, CISSP, CEH)
6. Experience in drafting p