Your search for Cyber & Information Security Jobs

Most effective learning paths in Dutch cybersecurity share a similar shape, even though people arrive from very different starting points: general IT, software development, networking and, increasingly, career changers who commit to building a technical foundation from scratch. A foundational certification such as CompTIA Security+ is a reasonable start and signals intent for entry-level roles.

From there the path diverges. Aspiring penetration testers should work towards OSCP, and OSEP for more advanced offensive roles, alongside regular hands-on practice, and in Dutch financial services, threat-led testing under DORA is creating its own route into red teaming. Those heading towards governance, risk or leadership will find CISSP and CISM increasingly relevant, and knowing NIS2 and the AVG is a practical advantage. The mistake we see most often is treating certifications as the whole strategy: they open doors, but the strongest candidates pair them with a genuine track record of practical work.

Employers hiring for cybersecurity roles tend to weigh demonstrable, hands-on capability more heavily than a CV built on qualifications alone. A handful of approaches consistently strengthen a candidate's position:

• Home lab work: setting up your own environment to practise attacks, defences and monitoring gives you something concrete to walk through at interview.
• Bug bounty and coordinated disclosure: finding and responsibly reporting real vulnerabilities is a strong signal, and the Netherlands has a particularly open disclosure culture, with volunteer-run organisations such as the Dutch Institute for Vulnerability Disclosure (DIVD) giving contributors real casework.
• Capture the flag (CTF) competitions: a well-regarded way to build and show practical skill, and a good talking point in interviews.
• Open-source contribution: contributing to security tooling shows initiative and gives interviewers something specific to discuss.
• Documented personal projects: even a well-written write-up of how you approached a specific vulnerability or exercise shows both skill and communication.

A strong portfolio of hands-on work will tend to outperform a generic computing degree with no practical evidence behind it. Certifications still matter, because they are a clear way to showcase knowledge, and OSCP in particular is often a gatekeeping requirement for penetration testing roles. If you're early in your search and unsure what to prioritise, it's worth talking to us before you invest months in the wrong preparation.

The specific technical requirements vary by specialism, but these skills come up consistently across the roles we recruit for:

• Networking fundamentals: a genuine understanding of how systems communicate, which underpins almost every security specialism.
• Operating systems: Windows and Linux, because understanding how systems can be exploited requires understanding how they work.
• Cloud security: Azure features most often in the roles we place, and certifications such as SC-200 and AWS Security Specialty appear regularly, particularly now that DORA applies to financial entities and the Cybersecurity Act (NIS2) has pulled a much wider set of organisations into scope.
• Threat detection and monitoring: SIEM tools and log analysis, core to SOC and incident response roles.
• Penetration testing: for offensive roles, hands-on capability matters more than tool familiarity, with OSCP and OSEP the certifications that carry weight.
• Governance and compliance: ISO 27001, the AVG and, increasingly, NIS2 itself, which is reshaping GRC and consultant hiring.
• Communication and stakeholder management: explaining risk clearly to non-technical leadership, increasingly critical with seniority.
• Scripting and automation: Python is useful across most technical specialisms for building tooling and automating analysis

The candidates who progress fastest are rarely those with the longest certification list. They are the ones who can explain a genuine trade-off they made under pressure, why a particular control mattered in a specific context, and what they learned from getting something wrong. That reasoning is what interviewers are testing for, whether the questions sound like it or not.

The highest-paying cyber roles are leadership and architecture: CISOs, heads of security and security architects, followed by scarce specialisms such as cloud security and incident response. With NIS2 and DORA putting security on the board agenda, those who can own it and explain risk in business terms command the strongest packages. Certifications help, but hands-on experience counts for more:

A few patterns show up consistently among candidates who struggle to break in:

• Collecting certifications without building practical skill: a stack of exam passes with no hands-on project behind it doesn't convince a hiring manager on its own.
• Targeting broad, generic roles instead of a specialism: candidates who present as open to anything in security often struggle more than those who commit to a clear direction, even early on.
• Underestimating communication: assuming cybersecurity is purely technical and neglecting the ability to explain risk to non-technical stakeholders.
• Waiting for the perfect CV before applying: applying and interviewing early teaches you what employers want, and an imperfect application usually costs less than waiting.
• Ignoring governance and compliance: even technical roles now expect baseline awareness of frameworks such as ISO 27001, the AVG and NIS2, which expanded who is regulated, and treating this as irrelevant is a common early mistake