Senior Consultant Strategy & Risk Public sector

• Salary between EUR 3,965 and EUR 5,050
• 30 vacation days (on a full-time basis) and the possibility to buy more days or sell your vacation days.
• A lease car + NS business card or the mobility allowance
• A flexible pension without a mandatory personal contribution.
• An extensive range of training and education that contributes to your professional and personal development.
• Attention to vitality! Exercising at the office in Amstelveen or a discount at a gym near you and access to coaching, health, and vitality programs
• 'Together' is one of our core values. You can therefore count on various social activities such as team outings, drinks, and events together with your colleagues

At KPMG as a consultant in Cyber Strategy & Risk, you will work on various projects for different clients. You will be part of an international, multidisciplinary, and motivated team with an informal, professional atmosphere. Through this challenging environment, you will get the opportunity to continuously learn and develop yourself into an expert within the field. 

As a Senior Consultant Cyber Strategy & Risk Public Sector, you advise ministries, executive organizations, regulators, and organizations within the security domain on complex cybersecurity and digital resilience issues.

You help clients to understand cyber threats and vulnerabilities, make cyber risks manageable, and structurally strengthen their digital resilience. In doing so, you work at the intersection of governance, organization, processes, and technology. You translate technical and organizational risks into concrete courses of action for executives, security professionals, IT management, and process owners.

For example, you work on developing a cybersecurity strategy, conducting a cybersecurity maturity assessment, redesigning security governance, or setting up a digital resilience program. You can also support clients with the implementation of the BIO, NIS2/Cybersecurity Act, and ISO 27001, or with strengthening crisis management, incident response, and operational resilience.

As a senior consultant, you take independent responsibility for a workflow or sub-project. You maintain daily client contact, organize interviews and workshops, analyze risks and control measures, and translate your findings into clear advice, roadmaps, and management reports. Additionally, you supervise and review the work of junior colleagues.

Specifically, you will be involved in:

• Developing and implementing cybersecurity strategies, security operating models, and multi-year cyber programs;
• Conducting cyber risk assessments, maturity assessments, and gap analyses;
• Assessing and improving cybersecurity governance, roles, responsibilities, and decision-making;
• Advising on the application and implementation of the BIO, NIS2/Cybersecurity Act, NIST CSF, ISO 27001/27002, CIS Controls, and GDPR;
• Translating threats, vulnerabilities, and technical findings into managerial and organizational risks;
• Developing improvement plans and roadmaps for digital resilience;
• Advising on cyber crisis management, incident response, business continuity, and operational resilience;
• Supporting the design and execution of cyber crisis exercises, tabletop exercises, and scenario analyses;
• Facilitating interviews, workshops, and decision-making with, among others, CISOs, CIOs, security officers, IT management, executives, and process owners;
• Performing quality reviews on analyses, reports, and client deliverables;
• Supervising and providing substantive coaching to consultants and junior consultants;
• Contributing to proposals, market development, and the further development of our cyber propositions for the public sector.

Variety and substantive depth characterize your work week. On Monday, you and your colleagues start a cybersecurity maturity assessment at an executive organization. You refine the approach, determine which stakeholders will be interviewed, and distribute the tasks within the project team.

On Tuesday, you facilitate a workshop with the CISO, CIO, and several process owners of a ministry. The central question is how the organization can translate the BIO and the Cybersecurity Act into governance, ownership, and an actionable improvement roadmap. Afterwards, you discuss with a junior colleague how the findings will be processed and you review the first analysis.

On Wednesday, you analyze the results of a cyber risk assessment together with technical specialists. You translate technical vulnerabilities and dependencies into concrete risks for critical processes and create a short management report from this.

On Thursday, you work at an organization within the security domain. You discuss the progress of a digital resilience program and help the client set up crisis management and incident response processes. In between, you coordinate with colleagues from other cyber disciplines regarding issues surrounding cloud security, identity & access management, or security monitoring.

On Friday, you work from the office with the Cyber Strategy & Risk team. You discuss ongoing assignments, coach junior colleagues, and contribute to a proposal for a new client. You also delve into current developments in the cyber threat landscape, relevant laws and regulations, and new applications of AI within cybersecurity.

There will also be periods during which you work at a single client organization for a longer duration. In that case, you are at the client's location several days a week and, together with your colleagues, you manage a program or project within the client environment. Even then, your work week includes analytical work, status meetings, substantive work on documentation, client presentations, and the Friday team day at the KPMG office.

Experience within the Dutch security domain is a definite advantage. Think of advisory or work experience at or for:

• the Ministry of Defence or parts of the armed forces;
• the National Police;
• the Ministry of Justice and Security;
• the National Cyber Security Centre;
• the Custodial Institutions Agency;
• the Royal Marechaussee;
• the National Coordinator for Counterterrorism and Security;
• security regions and crisis organizations;
• intelligence and security services;
• organizations responsible for national security, vital infrastructure, or public order.

Ideally, you understand the specific context of these organizations, including high-risk threats, sensitive or classified information, chain dependencies, operational continuity, and working within complex administrative and secure environments.