Senior Consultant Strategy & Risk Public sector

As a consultant in Cyber Strategy & Risk at KPMG, you will work on various projects for different clients. You will be part of an international, multidisciplinary, and motivated team with an informal, professional atmosphere. This challenging environment provides you with the opportunity to continuously learn and develop yourself into an expert within the field. 

What will you do? As a Senior Consultant Cyber Strategy & Risk Public Sector, you will advise ministries, executive organizations, regulators, and organizations within the security domain on complex cybersecurity and digital resilience issues. You will help clients understand cyber threats and vulnerabilities, make cyber risks manageable, and structurally strengthen their digital resilience. In doing so, you will work at the intersection of governance, organization, processes, and technology. You will translate technical and organizational risks into concrete courses of action for executives, security professionals, IT management, and process owners. For example, you might work on developing a cybersecurity strategy, conducting a cybersecurity maturity assessment, redesigning security governance, or setting up a digital resilience program. You can also support clients with the implementation of the BIO, NIS2/Cyberbeveiligingswet, and ISO 27001, or with strengthening crisis management, incident response, and operational resilience. As a senior consultant, you will independently take responsibility for a workflow or sub-project. You will maintain daily client contact, organize interviews and workshops, analyze risks and control measures, and translate your findings into clear advice, roadmaps, and management reports. Additionally, you will supervise and review the work of junior colleagues. Specifically, you will be involved in: Developing and implementing cybersecurity strategies, security operating models, and multi-year cyber programs; Conducting cyber risk assessments, maturity assessments, and gap analyses; Assessing and improving cybersecurity governance, roles, responsibilities, and decision-making; Advising on the application and implementation of the BIO, NIS2/Cyberbeveiligingswet, NIST CSF, ISO 27001/27002, CIS Controls, and AVG; Translating threats, vulnerabilities, and technical findings into managerial and organizational risks; Developing improvement plans and roadmaps for digital resilience; Advising on cyber crisis management, incident response, business continuity, and operational resilience; Supporting the design and execution of cyber crisis exercises, tabletop exercises, and scenario analyses; Facilitating interviews, workshops, and decision-making with, among others, CISO’s, CIO’s, security officers, IT management, executives, and process owners; Performing quality reviews on analyses, reports, and client deliverables; Supervising and providing substantive coaching to consultants and junior consultants; Contributing to proposals, market development, and the further development of our cyber propositions for the public sector.

A typical work week as a Senior Consultant Cyber Strategy & Risk Variety and substantive depth characterize your work week. On Monday, you and your colleagues start a cybersecurity maturity assessment at an executive organization. You refine the approach, determine which stakeholders will be interviewed, and distribute the tasks within the project team. On Tuesday, you lead a workshop with the CISO, CIO, and several process owners of a ministry. The central question is how the organization can translate the BIO and the Cyberbeveiligingswet into governance, ownership, and an actionable improvement roadmap. Afterwards, you discuss with a junior colleague how the findings will be processed and review the first analysis. On Wednesday, you analyze the results of a cyber risk assessment together with technical specialists. You translate technical vulnerabilities and dependencies into concrete risks for critical processes and create a short management report. On Thursday, you work at an organization within the security domain. You discuss the progress of a digital resilience program and help the client set up crisis management and incident response processes. In between, you coordinate with colleagues from other cyber disciplines regarding issues surrounding cloud security, identity & access management, or security monitoring. On Friday, you work from the office with the Cyber Strategy & Risk team. You discuss ongoing assignments, coach junior colleagues, and contribute to a proposal for a new client. You also delve into current developments in the cyber threat landscape, relevant laws and regulations, and new applications of AI within cybersecurity. There will also be periods where you work at a single client organization for a longer duration. In that case, you will be at the client location several days a week and, together with your colleagues, manage a program or project within the client environment. Even then, your work week includes analytical work, status meetings, substantive work on documentation, client presentations, and the Friday team day at the KPMG office.

Required experience and skills: You have at least three to five years of relevant work experience within cybersecurity, information security, IT-risk, digital resilience, or cyber transformation. You have demonstrable experience in an advisory, consultancy, CISO-office, security management, or similar role. You have independently contributed to multiple cyber projects, such as: cybersecurity strategy and transformation; cyber risk assessments; security maturity assessments; security governance and operating models; implementation of security legislation and frameworks; cyber crisis management and incident response; business continuity and operational resilience.

You have up-to-date knowledge of relevant cybersecurity frameworks and laws and regulations, such as BIO, NIS2/Cyberbeveiligingswet, ISO 27001/27002, NIST CSF, CIS Controls, and AVG. You understand the connection between prevention, detection, response, and recovery and can advise on this from technical, organizational, and managerial perspectives. You can translate complex technical and organizational cyber risks into clear advice for both security specialists and executives and business stakeholders. You have experience in preparing and facilitating interviews, workshops, and decision-making sessions. You are able to independently plan, execute, and substantively manage a workflow or sub-project. You have experience in supervising and reviewing the work of junior colleagues. You possess excellent analytical, written, and communicative skills. You have a command of the Dutch language at a minimum of C1 level and can communicate professionally in English. You have a completed HBO or WO education, for example, in cybersecurity, information security, computer science, public administration, security studies, crisis and security management, technical business administration, or a similar field. You have no objection to requesting a VOG or being screened for a VGB (A/B).

Strong and desired preference for experience and skills Experience within the Dutch security domain is a definite advantage. Think of advisory or work experience at or for: the Ministry of Defence or parts of the armed forces; the Nationale Politie; the Ministry of Justice and Security; the Nationaal Cyber Security Centrum; the Dienst Justitiële Inrichtingen; the Koninklijke Marechaussee; the Nationaal Coördinator Terrorismebestrijding en Veiligheid; security regions and crisis organizations; intelligence and security services; organizations responsible for national security, vital infrastructure, or public order. Ideally, you understand the specific context of these organizations, including high-risk threats, sensitive or classified information, chain dependencies, operational continuity, and working within complex administrative and secure environments.

Desired additional expertise It is a plus if you bring one or more of the following elements: a certification such as CISM, CISSP, CISA, CRISC, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, or CBCI; experience with cybersecurity in cloud environments; experience with security architecture, IAM, SOC/SIEM, or threat management; experience with ransomware resilience, incident response, or cyber crisis exercises; experience with the protection of vital infrastructure or operational technology; experience with cybersecurity programs in a political-administrative environment; a relevant network within the national government or the security domain; experience with European cybersecurity regulations and their translation to public organizations; affinity with AI and experience with issues surrounding AI-security, secure adoption, or the responsible application of generative AI.

Salary between EUR 3,965 and EUR 5,050 30 vacation days (on a full-time basis) and the possibility to buy more days or sell your vacation days. A lease car + NS business card or a mobility allowance. A flexible pension without mandatory personal contribution. An extensive range of training and courses that contribute to your professional and personal development. Attention to vitality! Exercising at the office in Amstelveen or a discount at a gym near you, as well as access to coaching, health, and vitality programs. 'Together' is one of our core values. Therefore, you can count on various social activities such as team outings, drinks, and events together with your colleagues.