Security Officer

Dear CISO Security Officer, you are the IT Security conscience of Rabobank.

You and your job

You challenge the business to embed IT security by design. You encourage the plethora of DevOps teams to achieve adherence to policy and standards from the start and to shift left, meaning that security built in early has more effect per euro than as an afterthought, or worse, as a surprise when all hard work is done and ready to ship into production.

Your principal business counterparts are those responsible for the technology stacks that run the bank, as well as their Security Professionals, your peers in the business, and the Security Champions, a role often taken by DevOps engineers who promote IT security day to day.

You translate technical risks into clear business insights and clear business decisions, and drive secure implementations across internal systems, cloud services and partner environments. You will operate in a global environment where threats evolve continuously and where shared responsibility and collaboration are key.

You are not alone. You are part of the CISO Office. You liaise with the CISO Policy unit, the Red Team, the Cyber Threat Intelligence unit, the Awareness department and a highly capable support office who know how to move colleagues in the bank. You also develop an open dialogue with the 2LoD and Audit. Your direct peers will be a team of around 20 seasoned Information Security Officers with diverse skills and backgrounds, all focused on ensuring high quality engineering while remaining demonstrably in control.

Practical Examples

• Empowering business counterparts to understand how IT risks affect the bank.
• Balancing AI adoption with digital sovereignty, supporting innovation in a responsible manner within the bank’s risk appetite, together with architects, policy makers and executives.
• Explaining your concerns in a way that resonates and shows alternatives to achieve what needs to get done within set boundaries.
• Drawing boundaries empathetically by explaining why certain hard limits exist, respectfully yet unambiguously.
• Reviewing high-risk third parties with procurement and business stakeholders who feel a compelling business need to employ such parties.
• Co-authoring standards for foundational components of the technology stack, such as low-code platforms, cryptography, or the use of AI and its implications for vulnerability management.

We are very curious about what you can bring to our team at the CISO Office / Security Experts team.

“No day is the same within security; we design secure solutions and advise business and IT on implementation across global environments. Our mission is clear: keep the bank safe 24/7.”

Sander, Manager

The 20 colleagues in the Security Experts team safeguard Rabobank’s information security by advising, assessing and improving risk management across domains. Working together is the way we work: as one pragmatic, analytical and expert team at Rabobank.

You and your talent

Experience & Background, please demonstrate in your writing:

• To judge IT risk, you need to understand IT and the dynamics in a modern IT department.
• Working and thinking level at least at University bachelors level (or Dutch: HBO). If you do not have the degree yet, please convince us by demonstrating your capability.
• Minimum of 5 years of working experience in risk and assurance functions within a large organization of more than 10,000 FTE in a heavily regulated industry such as finance.
• Motivation to work in a large corporate environment and the stamina to get things done.
• Ambition to grow within a dynamic security domain in a CISO / Chief Security context, advising business stakeholders.
• Ability to help build the CISO operating model in alignment with 2LoD and colleagues in other risk and compliance functions.

Knowledge & Skills

• Natural understanding of security risk management and standards.
• Strong personality, yet curious. Solid, yet charming.
• Ability to identify risks, patterns and trends and act proactively with those affected.
• Highly skilled in stakeholder management; you like to get things done with people.
• Ability to translate complex technical topics into clear business insights and decisions.
• Analytical, pragmatic and driven professional mindset.

Certifications

Certificates demonstrate a minimum standard, a foundation. You are willing to attain and maintain at least CISSP and CISM.

• CISA (auditor) or other assurance-related certifications are highly appreciated.
• Other certificates, such as ISACA’s AAIA, are offered regularly and willingness to obtain them is valued.
• Willingness to invest in continuous development and certifications.