Lead Cyber Security Culture

Lead Cyber Security Culture

Making security a natural part of how we innovate and serve millions of customers

• Utrecht
• Bachelor / Master
• 7-10 year
• 6.100-7.700

How do you make our customers happy?

By making security part of how bol thinks, builds and operates. You own and evolve our company-wide security culture strategy, helping colleagues, leaders and engineers make better security decisions every day. You turn human cyber risk into a meaningful foundation through behavioural insight, technical credibility, sharp prioritisation and communication that people actually remember. The result is that security becomes less of a mandatory checkbox and more of a natural part of how we innovate and serve millions of customers and partners.

Get to know Tech Expertise

This role is part of the Tech Expertise Job Family. Explore this Job Family to learn more about the purpose, key accountabilities and competencies.

The biggest challenge

Security matters to everyone, but it is rarely the first thing people wake up thinking about. Your challenge is to create lasting behavioural change across a fast-moving retail tech organisation with thousands of colleagues, many different audiences and constantly evolving threats. How do you make secure behaviour the easiest choice for an engineer deploying code, a leader weighing a business decision or a colleague experimenting with AI? You need to stand out among competing priorities and prove that your interventions genuinely reduce risk. This requires maintain and create one coherent culture without pretending that every audience needs the same message.

What you do as Lead Cyber Security Culture

You own security culture as a domain, not simply a calendar of campaigns. You set the strategy and maturity roadmap, translate security and business risks into behavioural priorities, and create measurable interventions that work across bol. In this role, you are the recognised expert and sparring partner for teams across Security, Product, Tech & Data, Risk, People&, Internal Communications and senior leadership. You combine strategic ownership with a willingness to build and test, whether you are advising leaders on a behavioural risk trend, redesigning a learning path for engineers, or testing a new nudge that makes secure behaviour easier. You use data to learn what works, stop what does not and scale the approaches that make a difference.

• Own and evolve bol’s security culture strategy, maturity roadmap and priorities.
• Define behavioural outcomes, KPIs and reporting that show whether initiatives reduce human cyber risk.
• Identify emerging security, technology and regulatory developments and translate them into relevant action for bol.
• Advise senior stakeholders on security culture trends, behavioural risks and effective interventions.
• Design and lead cross-company initiatives that embed secure behaviour throughout employee and engineering journeys.
• Drive adoption of secure engineering practices through targeted learning paths, technical workshops and a strong Security Champions community.
• Build organisation-wide capability for secure and responsible use of AI, supported by meaningful effectiveness measures.
• Ensure awareness and culture initiatives contribute to relevant compliance objectives, including NIS2 and DORA.
• Experiment with behavioural science, data and new learning formats, then use evidence to improve and scale them.
• Connect security specialists with the wider organisation and make complex topics clear without sanding off all the important edges.

Why you can make a difference

In this role, you get the space to develop a clear vision and bring colleagues along with you. You help us achieve a stronger security posture by bringing deep experience in security awareness, security culture, human risk management or a closely related cyber security domain. You set direction independently and turn an ambiguous domain into a clear strategy, roadmap and measurable outcomes. Because you understand cyber security well enough to challenge specialists and support engineers, you easily translate technical and regulatory risk into useful action. You influence across teams and levels without relying on formal authority, using evidence-based arguments that are adapted to the audience. You are comfortable combining behavioural change, communication, learning design and data, knowing that completion rates alone do not prove impact. You spot relevant trends, experiment with new approaches and share what you learn, including when an experiment flops spectacularly. You communicate confidently in Dutch and English and can make complicated subjects clear, engaging and actionable.

Strategic domain owner

You get energy from setting direction independently and turning an ambiguous domain into a clear strategy and roadmap.

Technical translator

You love translating complex technical and regulatory risks into useful, actionable steps for diverse audiences.

Evidence-based experimenter

You enjoy combining behavioural science, communication and data to test new approaches and measure real impact.

Predictability seeker

You prefer working with fixed, pre-defined campaigns rather than building and evolving a strategy from scratch.

Silo worker

You prefer working in isolation rather than collaborating closely with Security, Product, Tech & Data, Risk, People& and senior leadership.

Output over outcome

You focus on tracking simple completion rates rather than measuring actual behavioural change and risk reduction.

Where you'll be working

You join a large security organisation with plenty of expertise and room for your own ideas. Your scope spans bol: from colleagues taking their first steps in the organisation to engineers, senior managers and security specialists. Existing partners and learning solutions give you a foundation, while the domain ownership gives you the freedom and responsibility to decide what should evolve next. You will help build a security culture that supports how bol serves its customers, works with partners and keeps reinventing retail.

Perks of having a blue heart

29 days

to recharge

Travel costs

Public transport, car, parking & charging covered

Pension plan

75% premium covered

Annual bonus

Based on sustainability goals