Incident Manager

There is a moment during a severe cyber incident when a board stops asking about the technology and starts looking at you. What do we do now? What do we tell our customers? Will we survive this? At that moment, you are the one who brings calm, asks the right questions, and maps out the path to recovery for the client.

As an Incident Manager, you lead organizations through their most severe cyber crises, from the initial report to a secure restart. Along the way, you make the choices that contain the incident and leave the organization stronger than before.

This is not a role in which you work in the background. You stand there as the advisor moving between boards, management, technical specialists, employees, customers, and sometimes government agencies, constantly weighing the right interests against each other.

• You are the voice of calm and overview in a boardroom that has just heard that production has stopped, data may have been compromised, or the organization's continuity is acutely threatened.

• You translate complex, conflicting interests from multiple perspectives—for example, legal, technical, commercial, and human—into one clear line that actually helps the organization move forward toward returning to normal.

• You advise on what and what not to disclose publicly, when a regulator or law enforcement agency should be involved, and how to involve an insurer without losing the customer's trust.

• You see organizations enter in blind panic and depart again with a structurally stronger foundation in the area of cybersecurity.

• The client experiences calm, clarity, and confidence. At every moment, the client knows where you stand, which choices are being made, and what the next steps are. Precisely in a period where pressure from insurers, legal stakeholders, employees, and own customers is high, you are a stable and reliable guide.

• Your team knows what you expect of them, is given space for the work, and remains fit throughout the incident, even if the process lasts longer.

• You help the organization beyond just the incident. In a short time, you grasp the client's business operations, processes, and infrastructure. As a result, you identify not only the cause and impact of the incident but also the opportunities to structurally increase digital resilience.

• Incident management. You have full responsibility for complex cyber incidents from intake to completion. You monitor progress and make the decisions that contribute to a controlled recovery.

• Direction of your IR team. You lead multidisciplinary incident response teams, deploy the right expertise at the right time, and bring calm and structure to situations with high time pressure. For smaller incidents, you also participate operationally where necessary.

• Client management and communication at board level. You are the fixed point of contact for the client during the incident. Often, you represent the management yourself, speak the language of executives, and maintain their trust even when the news is not good.

• Coordination with insurer and partners. You coordinate with the involved insurer and other partners of the NW-CERT and keep them timely informed of costs incurred and expected.

• Quality of service. You monitor progress, costs, and expectations. You advise on additional services that further help the client, and ensure a high-quality final report and a careful handover to Business Security, SOC, and Account Management.

• Sales and client development. You identify opportunities to further support clients even after the incident, conduct sales conversations, and bridge the gap to Account Management.

• Evaluation and improvement. You organize the internal evaluation and ensure that lessons learned are translated into improvements within processes, tooling, and services.

• Contribution to the team. You participate in exercises and contribute to the coordination of daily issues within the CERT.

You are at your best when the pressure is highest. You are surrounded by specialists who dive deep into the technology, while you ensure that the right conversations are being held. You work with technical experts who challenge and complement you, while you maintain an overview, weigh risks, and ensure that the right decisions are made at the right time. What distinguishes you is how you hold your own among people with very different interests — a CFO looking at the numbers, a lawyer looking at liability, an IT manager looking at recovery, employees who are uncertain, and sometimes a regulator looking at compliance. You hold those interests together, without anyone being sidelined. 

• Presence and persuasiveness at executive level. You feel at ease in a high-tension boardroom, speak with natural authority toward management and boards, and know how to win trust at the exact moment an organization is most vulnerable. 

• Bringing structure to chaos. You step into an organization at one of its most vulnerable moments. Often the situation is unclear, facts and assumptions are mixed up, and pressure increases rapidly. You bring structure, create overview, determine priorities, and ensure the right people are at the table. This creates calm, direction, and control over the incident. 

• Calm, clear communication style under pressure. You continue to think, communicate, and decide clearly when a client is in crisis and multiple tracks are running simultaneously. You bring calm and direction, and maintain ownership until the incident is truly completed. 

• The ability to weigh and connect interests. You switch effortlessly between boards, legal, technical specialists, employees, customers, and where necessary government agencies, and always know how to maintain the balance between what is legally required, technically possible, and organizationally effective. 

• Empathy and team leadership under pressure. You sense what a team needs to sustain a heavy, sometimes weeks-long process and ensure people remain fit and motivated, even when the client is having a hard time. 

• Flexibility and international working environment. You are willing to work irregular hours (evenings, weekends, long-term processes) and move easily in a setting with clients and colleagues in multiple countries. Where necessary, you support clients on location, also outside the Netherlands. 

• You are fluent in Dutch and English, both written and spoken. 

Where we offer a learning curve in the first year 

• Technical depth. You have demonstrable experience in a coordinating or leading role during crises and incidents, but above all a strong interest and affinity to learn more regarding technical insight.  

• You make a visible difference at an organization's most difficult moment. No other role within cybersecurity brings you so directly into the heart of a crisis. One in which your direction and control make the difference between chaos, damage, and a controlled recovery. 

• You build a unique combination of skills that few people possess: crisis leadership, technical insight, legal awareness, and commercial sense, all under high pressure. 

• You work in an international, fast-growing CERT with multidisciplinary teams of forensic investigators, recovery experts, and negotiators; you are never alone, even though you are the one in control. 

• Every incident makes you sharper. Lessons learned translate directly back into our processes, tooling, and services - your work has a lasting effect, also for future clients.