Domain Expert III - Security Testing

• An attractive gross monthly salary based on a 36-hour work week, including holiday allowanceand a flexible benefit budget.
• An excellent pension scheme, ensuring that you are well prepared for the future.
• Flexibility in working: working from home is possible in consultation with your team and depending on your role. We will provide an ergonomic home office setup for you.
• Plenty of room for relaxation with five weeks of vacation per year, supplemented by two mandatory days off. You can also purchase up to four additional weeks of vacation annually.
• Five "Banking for better days": extra days off that you can use for personal development or volunteer work.
• Personal development is key: you receive a development budget of €1,000 per year, which can accumulate up to €3,000.
• An annual public transport pass with free public transportation throughout the Netherlands for both business and private use.

We believe it is important to be a good employer. Joining us means stepping into a role with impact, supported by excellent employment conditions that foster your job satisfaction, development, and wellbeing.

In addition, we offer:

You can find more information about our employment conditions and salary scales in our Collective Labour Agreement (CLA), which applies to this vacancy.

Cyber threats are evolving rapidly. Attackers increasingly use automation and AI, regulation raises the bar for security testing, and traditional periodic testing alone is no longer enough.

As Domain Expert Security Testing, you lead the development of our security testing capability within our Security Assurance team. You provide functional and technical leadership across penetration testing, red teaming, coordinated vulnerability disclosure and regulatory security testing, including DORA/TLPT.

Your goal is simple: make sure we continuously challenge our security and know whether our defences actually work.

As Domain Expert Security Testing, you are the functional and technical lead for the Security Testing domain. You set the direction for how we test and validate the security of the bank and ensure our capabilities evolve with changes in technology, threats and regulation.

You work with experienced offensive security specialists and provide direction on methodologies, capabilities and complex testing activities. You help determine where expert-led testing provides the most value and where automation, continuous validation and AI can make us faster and more effective.

Security Testing is also an important part of our journey towards Continuous Threat Exposure Management (CTEM). Rather than looking at vulnerabilities in isolation, we increasingly want to understand whether exposures can actually be exploited, how they can be combined into attack paths and what they mean for the bank.

You therefore connect offensive security expertise with the broader exposure management strategy.

You will:

• Lead the further development of penetration testing, red teaming and coordinated vulnerability disclosure capabilities.
• Drive security testing focused on the exposures that matter most.
• Provide expert direction for complex and high-impact security testing engagements.
• Drive the integration of Security Testing and exposure validation into CTEM.
• Explore and implement opportunities for continuous, automated and AI-assisted security testing.
• Raise the technical bar by challenging, coaching and connecting security specialists.
• Ensure regulatory requirements such as DORA/TLPT are translated into effective testing capabilities.
• Improve methodologies, standards, tooling and ways of working.
• Challenge and guide external security testing partners.
• Translate technical outcomes into actionable insights for our stakeholders.
• Identify capability gaps and turn them into concrete improvements.