ppCMS Belgium is looking for a bSenior Consultant in Cyber Digital Law /b to reinforce its Technology, Media Communications law practice between Brussels and Antwerp. /p h3bProfile /b /h3 h3bEssential /b /h3 ul liA Belgian law degree (Master in Laws or equivalent). Admission to the bar is not required — we welcome candidates from law firms, consultancies, in-house legal or compliance teams, regulators and public authorities alike /li liAt least 3–5 years of relevant professional experience in data protection, cybersecurity, technology or digital regulation /li liSolid working knowledge of EU and Belgian digital law, and genuine interest in keeping that knowledge current in a field that changes constantly /li liA keen interest in IT and cybersecurity — you enjoy understanding how the technology actually works, follow the threat landscape, and are curious about what sits behind the legal questions /li liFluency in Dutch and English, both written and spoken. French is a strong asset /li liSelf-propelled and pro-active: you identify what needs to happen and take it forward without waiting to be asked /li liStrong communicator, able to explain legal and regulatory issues clearly to CISOs, IT teams, executives and boards — not only to lawyers /li liComposure and sound judgment under time pressure, and the discretion that sensitive incident work demands /li liWillingness to participate in a standby rota, given the unpredictable nature of incidents /li /ul h3bNice to have /b /h3 ul liPrior involvement in live breach or incident response matters /li liFamiliarity with security frameworks and standards such as ISO/IEC 27001, NIS2 CyberFundamentals or the NIST CSF /li liCertifications such as CIPP/E, CIPM, CISM or CISSP /li liExperience in a regulated sector — financial services, healthcare, energy, telecoms or critical infrastructure /li liEnough technical literacy to hold a credible conversation with a forensic team (you do not need to be an engineer) /li /ul h3bThe role /b /h3 pWe are looking for a bSenior Consultant – Cyber Digital Law /b to strengthen our cyber and digital regulatory team. You will work as a consultant alongside our lawyers, combining hands‑on incident response support with regulatory advisory work. /p pThe position has two clear halves. /p pbIncident response (non-technical). /b You act as a calm, structured point of contact when clients are dealing with a cyber incident — coordinating the various workstreams (digital forensics, legal, communications, insurance, etc.). /p pbDigital regulatory advisory. /b Between incidents, you advise clients on compliance with digital laws regulations: data protection, cybersecurity regulation, AI, data governance and platform rules. /p pYou will report to the partner leading the TMC practice and work closely with colleagues in the Belgian TMC team and across the CMS network on cross‑border matters. /p h3bWhat you will do /b /h3 pbIncident response /b /p ul liServe as first point of contact for clients reporting a cyber incident, the intake and scoping process, manage the status update meetings and act as the liaison with cyber insurers /li liCoordinate the incident workstream between the client, forensic investigators, IT and security providers, insurers, brokers and communications advisers /li liAssess notification and reporting obligations across regimes — GDPR and the Belgian Data Protection Act, the Belgian NIS2 Law and CCB / CERT.be reporting, DORA, sectoral and contractual duties — and manage the timelines these create /li liDraft notifications to the Data Protection Authority, the CCB, sectoral supervisors and other regulators, as well as communications to data subjects, customers and business partners /li liManage external service providers assisting clients (e.g. digital forensics providers; threat actor engagement providers; crisis communications consultants; etc.) /li liSupport decision‑making in extortion and ransomware scenarios, including the legal and sanctions‑related considerations around payment /li liRun post‑incident reviews and translate the findings into concrete improvements for the client /li liBuild and test client readiness: incident response plans and playbooks, escalation matrices, tabletop exercises and training for legal, IT and executive teams /li liHelp develop and manage our incident response retainers and standby arrangements /li /ul pbRegulatory advisory /b /p ul liAdvise on GDPR and Belgian data protection law: governance frameworks, DPIAs, international transfers, data subject rights, records and retention, and vendor management /li liAdvise on the cybersecurity regulatory landscape — NIS2 and its Belgian implementation, the CyberFundamentals framework, DORA, the Cyber Resilience Act and sectoral security requirements — including scoping, gap analyses and compliance roadmaps /li liAdvise on emerging digital regulation: the AI Act, the Data Act, the Data Governance Act, the DSA and DMA, eIDAS and cloud and outsourcing
