Key Management Consultant

Project overview

Three reasons why this is your assignment

Some background information: The SVB increasingly has to take into account changing requirements such as NIS2, BIO2, privacy, and sovereignty choices. There are increasing demands and audit obligations, leading the SVB to investigate whether risk mitigation needs to be approached differently. One of the research questions concerns the management of digital keys. Should it be managed in-house to reduce dependency on external suppliers or service providers for our encryption keys? Or should the organization be unburdened and outsource this to a service provider?

Having direct control over who has access to sensitive systems and data increases our control over security risks, makes it easier to comply with laws and regulations, and reduces the risk of issues arising from problems or changes with external parties. Furthermore, an in-house solution allows us to respond more flexibly to new security requirements and future developments such as Quantum encryption. This makes us more agile and gives us more control over our data. However, managing this responsibility in-house also demands a lot from the organization.

The possibility of outsourcing this management to a service provider also needs to be investigated.

You will do it

Research is desired into what is needed for the organization to gain control over our encryption keys using its own HSM (Hardware Security Module). By researching what is needed to store these keys centrally and in-house, we will gain better insight into the benefits, risks, costs, and consequences for the organization. The research must answer questions such as: What are the advantages and disadvantages of this solution for the SVB, and is it better to handle it externally or internally? Which systems and applications are in scope? What do we want to do ourselves and potentially outsource?

What security requirements do we impose on this solution? What knowledge and capacity do we need to securely manage an HSM? What dependencies exist, such as a proper OTAP environment, staffing, knowledge, and policy? What costs and investments are necessary? With the outcomes of thorough research, the organization can make an informed choice whether an HSM is the right solution and what steps are needed to implement it successfully. This consultancy request is supported by the IT directorate.

The question: Hiring external consultancy to further elaborate on the above case and provide an answer. The involved party should be aware that in case of a possible tender, there may be a role conflict if they also wish to participate in the tender.

You are

Demonstrable knowledge and experience in this field with the execution of strategic consultancy. Preferably vendor and brand independent.

Project details

4 to 8 weeks

Available for at least 16 to 36 hours per week during this period

Additional information

When you offer a professional to us as a supplier and they are placed, we need information from you as a contracting party, including regarding the Liability of Chains Act (Wet keten- en inlenersaansprakelijkheid). The 'WKA' aims to prevent abuse in the remittance of payroll taxes at all links in the chain; from supplier to client. We mitigate these risks for our clients by means of a blocked account, the G-account. This is an account to which part of the invoice amount is deposited and from which you can pay payroll taxes and VAT to the Tax Authorities.

The percentage to be deposited depends on whether you have SNA certification (NEN-4400-1 or NEN-4400-2) and whether your company is based in the Netherlands or abroad. You can apply for the G-account from the Tax Authorities. If you cannot obtain a G-account (and you can provide proof of this from the Tax Authorities), you also have the option to provide an accountant's statement (assurance report regarding personnel lending) every quarter. In this, a certified accountant (AA or RA) will issue a statement on the accuracy, completeness, and timeliness of the remittances.

Well, the costs for this statement are for your own account.

• Start: 2026-11-15T23:00:00
• Location: Amstelveen Noord-Holland, NL
• Languages: Dutch