Security Consultant - Vulnerability Management.
As a Vulnerability Management Consultant, you'll join a cybersecurity consultancy practice at Randstad Digital that is still very much in development. Instead of classic staffing arrangements, you work on results-driven assignments (statement of work) primarily for mid-sized organizations (roughly 250–1,250 FTE) that want to accelerate their security maturity.
You become the subject-matter specialist who ensures vulnerabilities don't just end up in reports, but are actually structurally reduced.
You're not an anonymous "resource" at a single client, but part of a recognizable cyber team that delivers a solution as a whole.
What you'll be doing.
At clients, you set up the full end-to-end vulnerability management process or professionalize what's already in place. You analyze the current situation (tools, scope, processes, reporting, and role distribution), design a workable process for discovery, scanning, triage, prioritization, follow-up, remediation, and reporting, and document this in processes and work instructions that enable the client to continue independently. You work with common scanners and platforms (depending on the client environment) and ensure proper integration with existing ITSM, change, and development processes, for example through ticketing integrations or alignment with patch and release procedures.
You always approach vulnerabilities in a risk-driven way. You help clients prioritize based on business impact, exploitability, and existing compensating controls, and together with them weigh the choice between fixing immediately, mitigating, or (temporarily) accepting. You coordinate this with governance and risk colleagues so findings are properly reflected in risk registers, exception processes, and compliance obligations (for example toward ISO 27001 and NIS2).
You then actively guide remediation: you work closely with infrastructure teams, developers, and vendors to actually get fixes rolled out, remove practical obstacles, and help clients build a realistic patch and remediation cadence.
An important part of your work is making progress and impact visible. You develop dashboards and management reports that are understandable for C-level and IT management, but also detailed enough for technical teams. This way, you make trends visible in the number and criticality of vulnerabilities, turnaround times, and recurring findings, and you can demonstrate that security maturity is genuinely growing.
You also help build Randstad Digital's proposition. Together with colleagues, you develop reusable approaches such as a "Vulnerability Management Quickscan" or "Vuln-as-a-Service" within broader security and NIS2 programs. You work closely with governance consultants (ISO/NIS2), BCM/DR/IR specialists, cyber project/program managers, and IAM/PAM specialists in multidisciplinary teams.
What you bring.
We're looking for demonstrable experience in vulnerability management within mid-sized or large environments, for example as a security engineer, security specialist, or TISO. You've done more than just scanning: you've set up or improved processes, established prioritization, and coordinated remediation. You understand the underlying technology (infrastructure, network, OS and/or applications), but you find it equally important that processes work, that reporting is clear, and that the number of vulnerabilities actually decreases.
Who you are.
As a person, you're results-oriented, pragmatic, and entrepreneurial. You consider it important to achieve demonstrable improvements rather than just producing nice reports. You deliberately join a practice that is still growing and enjoy thinking along about how things can be done smarter and better. You communicate easily at different levels and know how to stay constructive toward teams that need to implement the fixes, even under pressure or resistance. You enjoy collaborating, see the added value of a team at the office, and want to be part of a multidisciplinary cyber team rather than being "solo staffed" at a client.
What the organization offers.
The position is positioned at a mid-to-senior level. The exact salary grade and employment conditions depend on your experience, but align with substantial technical security roles within a large, professional organization.
You work in a hybrid setup: typically one fixed day per week with the team at the office in Utrecht, and the remaining days at clients and/or from home, with a reasonable maximum commute time as a starting point. The clients you work for are mainly mid-sized for-profit and non-profit organizations in sectors such as energy, industry, transportation, and healthcare, where there's still significant room for improvement in security maturity and where your work therefore makes a real, visible difference.
Apply now.
Your details go straight into our system — no middlemen, no mailing lists.