Domain Expert III - Security Testing

At a glance

Domain Expert III - Security Testing. Cyber threats are evolving rapidly. Attackers increasingly use automation and AI, regulation raises the bar for security testing, and traditional periodic testing alone is no longer enough.

As Domain Expert Security Testing, you lead the development of our security testing capability within our Security Assurance team. You provide functional and technical leadership across penetration testing, red teaming, coordinated vulnerability disclosure and regulatory security testing, including DORA/TLPT.

Your goal is simple: make sure we continuously challenge our security and know whether our defences actually work.

• Location: Nederland Amstelveen
• IT
• Working hours: 36-40
• Schaal 12: € 7.048 - € 10.068 pm

Your job

As Domain Expert Security Testing, you are the functional and technical lead for the Security Testing domain. You set the direction for how we test and validate the security of the bank and ensure our capabilities evolve with changes in technology, threats and regulation.

You work with experienced offensive security specialists and provide direction on methodologies, capabilities and complex testing activities. You help determine where expert-led testing provides the most value and where automation, continuous validation and AI can make us faster and more effective.

Security Testing is also an important part of our journey towards Continuous Threat Exposure Management (CTEM). Rather than looking at vulnerabilities in isolation, we increasingly want to understand whether exposures can actually be exploited, how they can be combined into attack paths and what they mean for the bank.

You therefore connect offensive security expertise with the broader exposure management strategy.

You will:

• Lead the further development of penetration testing, red teaming and coordinated vulnerability disclosure capabilities.
• Drive security testing focused on the exposures that matter most.
• Provide expert direction for complex and high-impact security testing engagements.
• Drive the integration of Security Testing and exposure validation into CTEM.
• Explore and implement opportunities for continuous, automated and AI-assisted security testing.
• Raise the technical bar by challenging, coaching and connecting security specialists.
• Ensure regulatory requirements such as DORA/TLPT are translated into effective testing capabilities.
• Improve methodologies, standards, tooling and ways of working.
• Challenge and guide external security testing partners.
• Translate technical outcomes into actionable insights for our stakeholders.
• Identify capability gaps and turn them into concrete improvements.

Working environment

You will be part of the Security Assurance team within the Corporate Information Security Office (CISO) of ABN AMRO in the Netherlands. As Security Assurance team we identify, understand and validate cyber exposure across the bank. Security Testing brings together specialists with deep expertise in offensive security. The environment is highly technical, but the impact goes beyond individual tests. Our ambition is to move from predominantly periodic security testing towards a more continuous model of exposure validation.

You work closely with the Product Owner and Expert Lead, each with a distinct responsibility. The Product Owner determines priorities and ensures the team focuses on the work that delivers the most value. The Expert Lead creates the environment in which people and teams can perform and develop. As Domain Expert, you own the functional and technical direction: what good Security Testing looks like, how our capabilities should evolve and what expertise we need to stay ahead. Together, you turn strategy into execution.

Your profile

Must have:

• Have extensive experience in penetration testing, red teaming, coordinated vulnerability disclosure or another offensive security discipline.
• Understand modern attack techniques across applications, infrastructure, cloud and identity environments.
• Can think beyond individual vulnerabilities and reason about attack paths and real-world exploitability.
• Have experience developing security testing methodologies or capabilities.
• Can provide technical leadership without needing to be the person performing every test yourself.
• Are comfortable challenging experienced specialists and senior stakeholders.
• Understand how automation and AI are changing both offensive security and security testing.
• Can translate complex technical subjects into clear decisions and priorities.

Nice to have:

• Understand regulatory security testing; experience with DORA/TLPT.
• Experience with product ownership in an agile working environment.
• Understanding of and experience with working in complex IT environments.

We are offering

We believe it is important to be a good employer. Joining us means stepping into a role with impact, supported by excellent employment conditions that foster your job satisfaction, development, and wellbeing.

In addition, we offer:

• An attractive gross monthly salary based on a 36-hour work week, including holiday allowanceand a flexible benefit budget.
• An excellent pension scheme, ensuring that you are well prepared for the future.
• Flexibility in working: working from home is possible in consultation with your team and depending on your role. We will provide an ergonomic home office setup for you.
• Plenty of room for relaxation with five weeks of vacation per year, supplemented by two mandatory days off. You can also purchase up to four additional weeks of vacation annually.
• Five “Banking for better days”: extra days off that you can use for personal development or volunteer work.
• Personal development is key: you receive a development budget of €1,000 per year, which can accumulate up to €3,000.
• An annual public transport pass with free public transportation throughout the Netherlands for both business and private use.

You can find more information about our employment conditions and salary scales in our Collective Labour Agreement (CLA), which applies to this vacancy.