Open role
Security Professional - FEC
IQ Staffing B.V.
About the role
Security Professional — Fraud & Sanctions Detection
You're the security conscience of a set of engineering teams building fraud and sanctions detection systems. Not the person who says no at the end, but the one in the room during refinement and design, making sure security is built in rather than bolted on. Threat modelling workshops, vulnerability reviews, secure coding, and the slow structural work of turning reactive firefighting into secure-by-design.
It's a bridging role by nature: engineers, architects, risk officers and product owners all sit on different sides of it, and you're the one making the security conversation land with each of them.
The environment
Our client is a financial organisation, and you'll support the teams responsible for detecting external fraud and screening against sanctions — a domain where a missed control is a regulatory problem, not just a technical one. The work sits at the intersection of engineering delivery and financial crime prevention.
You'll work in agile, DevOps-oriented teams and connect into the wider security and risk community, contributing to working groups and governance forums beyond your own teams.
What you'll do
Act as the security point of contact for your teams and the liaison to security specialists, risk officers and architects.
Facilitate threat modelling workshops and review architectures against Zero Trust and defence-in-depth principles.
Define security acceptance criteria for epics and user stories, including abuse cases and attack scenarios.
Chair vulnerability reviews across supported applications, coordinate remediation of high and critical findings, and chase down the overdue ones.
Embed SAST, DAST and SCA controls into CI/CD pipelines, and support penetration testing and security assessments.
Strengthen controls in practice: authentication, least-privilege access, secrets management, encryption in transit and at rest, security logging and monitoring.
Support incident investigation and root-cause analysis, feeding the lessons back into detection use cases, team practice and your reporting on security posture to management.
Frameworks & technical ground
Core: Secure SDLC · threat modelling · OWASP Top 10 · vulnerability management · identity & access management · DevSecOps and CI/CD security controls
Standards: ISO 27001 · NIST Cybersecurity Framework · DORA
Also in the mix: cloud security (Azure) · Zero Trust architecture · encryption and key management · security monitoring · Python and KQL scripting
What you'll bring
Must-haves
Three to five years across one or more of: cyber security, security engineering, DevOps/platform engineering, IT risk management or software engineering.
Practical secure-by-design experience — threat modelling, secure SDLC, OWASP Top 10 — rather than policy knowledge alone.
A track record of supporting vulnerability remediation and getting security controls actually implemented.
Comfort working in agile and DevOps environments, close to the engineers.
The stakeholder skills to influence without authority, across engineering, security, risk and business.
Strong communication and presentation skills in both English and Dutch.
Nice to have
A background in banking, payments, financial economic crime or another regulated environment.
Cloud security controls, particularly on Azure.
Participation in penetration testing, audits and risk assessments.
Certifications such as CompTIA Security+, SC-900, CISSP, CISM, CCSP or GIAC (GSEC, GCIH).
A bachelor's degree in computer science, cyber security, information security, IT or engineering — or an equivalent combination of education and experience. You're the kind of person who coaches rather than polices, and who can hold the line on risk without becoming the reason delivery stalls.
Good to know
The role is hybrid, based in the Utrecht region.
You'll need to operate in both Dutch and English.
A pre-employment screening is part of the process — standard for the financial sector.