Help with a situation.
Sometimes it doesn't start with a job title but with something that comes up: a law taking effect, a customer demanding a certification, a colleague leaving. Below, per situation, what needs to happen, who leads it, and how fast we get that person to the table. For interim that's within two days; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments, and that is exactly our work.
Already know which role you need? Then you're better off at permanent recruitment or interim security.
Laws and regulations.
The Cyber Resilience Act is coming, and the product isn't ready for it
The Cyber Resilience Act applies to anyone placing products with digital elements on the European market, from machines and devices to software. The reporting obligation for exploited vulnerabilities starts on 11 September 2026, the full requirements on 11 December 2027. If nobody internally is leading security-by-design, the vulnerability processes and CE conformity, you'll have an experienced product security specialist interviewed within two days. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Laws and regulationsA data protection officer needed, or the DPO just left
The GDPR requires organisations that monitor people on a large scale or process special categories of personal data to appoint a data protection officer, and that officer may be external. Whether the DPO is leaving, the Dutch Data Protection Authority is asking questions, or a customer wants to know who your privacy officer is: you'll have an experienced DPO or privacy officer interviewed within two days. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Laws and regulationsDORA, and the regulator wants to see it evidenced
DORA has applied since 17 January 2025 to banks, insurers, investment firms, payment institutions and other financial entities, and DNB and the AFM ask for it to be evidenced every year: ICT risk management, incident reporting, testing and the register of ICT providers. If nobody internally has the time or the experience to lead that, you'll have an experienced DORAn interim specialist interviewed within two days. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Laws and regulationsA customer demands ISO 27001, and nobody has time for it
A customer or tender demands an ISO 27001 certificate, usually with a date attached, and internally nobody has the time or the experience to lead that programme. Within two days you'll have an experienced lead implementer interviewed who has done this before. If what you actually need is a permanent security officer, we recruit those just as well, though not within two days.
Read more Laws and regulationsNIS2 and the Dutch Cybersecurity Act, someone to lead it
The Dutch Cybersecurity Act (Cbw), the national implementation of NIS2, has applied since 15 August 2026 without a transition period. If your organisation falls under it and no one is leading the programme, you'll have a senior interim professional who has done this before interviewed within two days, as a freelancer in a construction that passes the Dutch DBA test, with a margin you can see. If what you actually need is a permanent security officer, we recruit those just as well, though not within two days.
Read moreContinuity.
An acquisition, and security needs to be assessed or merged
In an acquisition the buyer wants to know what security risks it is taking on, and after the deal two environments, two sets of policies and two teams have to become one. That work comes on top of everything already running, with a deadline set by the deal. Within two days you'll have an experienced security specialist interviewed who leads the due diligence or the integration. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more ContinuityYour CISO or security officer is leaving, and the chair can't stay empty
A CISO who resigns, a security officer who is out for months or goes on leave, and a successor who is four months away at best. Meanwhile the audits, the supplier questions and the incidents simply carry on. Within two days you'll have an experienced interim CISO or security officer interviewed who takes over the role and, if you want, helps find the permanent successor.
Read more ContinuityYour first security lead, because a customer or investor is asking
A scale-up or growing company that handled security "on the side" until a major customer sends a security questionnaire, an investor asks for policies during due diligence or an insurer sets requirements. Then, for the first time, someone has to be responsible. Within two days you'll have an experienced vCISO or security officer interviewed who sets up the programme; if you want someone permanent right away, we recruit that person just as well, though not within two days.
Read more ContinuityThat security vacancy has been open for months
A vacancy for a security engineer, security officer or CISO that has been open for a quarter or longer, a team doing the work on the side in the meantime, and projects waiting. Within two days you'll have an interim professional interviewed who picks up the work, and meanwhile we find the permanent candidate who does fit. That is exactly the point where our two service lines meet.
Read moreAfter an incident.
Supply chain and customers.
Technology and projects.
Building a SOC, and then leaving it with your own people
After an incident, an insurer requirement or a NIS2 obligation, the organisation wants to see for itself what's happening in the network and respond to it. That means logging that's right, a SIEM or detection platform that's configured, use cases that catch real attacks, and people who know what to do with an alert. Within two days you'll have an experienced SOC lead or detection engineer interviewed who builds that and, this being the point, leaves it with your own team. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Technology and projectsAn IAM programme that has stalled, with the auditor watching
Identity and access management is the project every organisation starts and almost nobody finishes: the tool is bought, the first integrations are in place, and then it stalls on roles nobody can define, applications that don't cooperate and an auditor who writes the same finding about excessive rights every year. Within two days you'll have an experienced IAM specialist interviewed who gets the programme moving again and finishes it. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Technology and projectsA network security project: segmentation, firewall migration or zero trust
The flat network in which one infected laptop can reach everything, the firewall going out of support at the end of the year, the insurer or the pentester asking for segmentation, or the ambition to move to zero trust without anyone knowing where to start. These are projects with a hard end date and a high risk of disruption, and your own network administrators have their hands full with the day job. Within two days you'll have an experienced network security engineer or architect interviewed who designs and executes it, alongside your own team. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Technology and projectsOT security on the factory floor, where IT rules don't simply apply
Production lines, process automation and building management run on systems that last twenty years, can't be patched and are connected to the office network because that was convenient once. The Dutch Cybersecurity Act, an insurer, a customer or an incident at a fellow manufacturer suddenly makes that urgent, and IT doesn't know the factory and the factory doesn't trust IT. Within two days you'll have an experienced OT security specialist interviewed who speaks both languages and sets up the programme without halting the line. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Technology and projectsThe pentest report is in, and nobody is fixing the findings
The pentest was required for a customer, a certification or the insurer, and the report is honest: thirty findings, six of them high. Then what always happens, happens: the development team has a roadmap, the administrators have the day job, and at next year's retest the same six are there again. Within two days you'll have an experienced security engineer or AppSec specialist interviewed who fixes the findings with the team and makes sure the next test is shorter. If you need someone permanently, we recruit that person just as well, though not within two days.
Read more Technology and projectsA cloud migration that needs securing, and the team doesn't have the hands for it
The cloud migration is scheduled, the vendor and the project team are in place, and then it turns out nobody is designing and setting up the security of the new environment: identity, network, logging, the guardrails that stop every engineer from making their own rules. Within two days you'll have an experienced cloud security engineer or architect interviewed who takes that on for the duration of the project and leaves it with the team. If you need someone permanently, we recruit that person just as well, though not within two days.
Read moreSomething else going on?
Tell us what's going on. We'll say honestly whether we can help, and if so with whom.