Senior Project Manager Cybersecurity Law (NIS2) & Third Party Risk Management

Project overview

Three reasons why this is your assignment

You are an experienced project manager who successfully realizes complex change processes at the intersection of information security, supplier management, and governance. You have experience with Cybersecurity Law (NIS2), Baseline Information Security Government, cybersecurity, compliance, and Third Party Risk Management and know how to translate laws and regulations into workable solutions. You get energized by connecting diverse disciplines and stakeholders and know how to anchor changes sustainably within the organization.

You do it

As an Interim Project Manager Cybersecurity Law (NIS2) & Third Party Risk Management, you are responsible for organizing, managing, and realizing the implementation of the Cybersecurity Law (NIS2) within the SVB. You ensure an integrated approach where policy, processes, governance, contracts, and execution are developed and implemented in coherence. You operate under the direction of the Manager Procurement & Contract and Supplier Management (ICLM).

This is a deliberate positioning: an important part of the Cybersecurity Law concerns identifying, assessing, managing, and monitoring risks within the supplier chain. The ICLM department plays a central role within the SVB in supplier management, contract management, and Third Party Risk Management and is therefore an essential link in achieving compliance with the Cybersecurity Law (NIS2).

You will work organization-wide with the CIO Office, CISO, Information Security, Privacy, Risk Management, and the business. With your experience, you will provide direction to an organizational change that impacts the entire SVB and its supplier chain. You will ensure support, clear decision-making, and manageable implementation.

We can count on you as an Interim Project Manager Cybersecurity Law (NIS2) & Third Party Risk Management for:

developing and realizing the implementation approach for the Cybersecurity Law (NIS2) within the SVB;

preparing a project plan including schedule, governance, risks, dependencies, and milestones;

translating obligations into supplier management, contract management, and Third Party Risk Management;

organizing decision-making on roles, responsibilities, and governance;

developing uniform assessment frameworks for suppliers and contractual compliance;

realizing support from management, specialists, and process owners;

effectively connecting the interests of CIO, CISO, Information Security, Privacy, Risk Management, Procurement, and Contract Management;

guiding decision-making within steering committees and management meetings;

managing working groups and involved specialists;

coordinating the analysis and reassessment of approximately 60 strategic supplier contracts;

setting up processes for registration, monitoring, and follow-up of obligations;

developing standard documentation, clauses, work instructions, and control measures;

identifying and managing project risks;

realizing sustainable embedding within the line organization.

You are it (requirements)

You are a strong and results-oriented project manager who can realize change in a complex administrative environment. You understand the coherence between laws and regulations, governance, supplier management, information security, and business operations and are able to bring different interests together. You understand that Cybersecurity Law (NIS2) is not exclusively a compliance issue, but primarily an organization-wide change task that requires collaboration between multiple disciplines. You know how to translate policy requirements into practical, workable solutions and create support for implementation.

You can easily switch between strategy and execution and know how to involve people in change. Thanks to your organizational sensitivity, persuasiveness, and ability to connect, you achieve sustainable results. You are independent, decisive, and stay on course, even when responsibilities are divided across multiple organizational units or interests diverge.

You possess:

Academic work and thinking level;

minimum of 7 years of experience as a project manager or program manager;

have demonstrably led at least one comparable Cybersecurity Law (NIS2) or cybersecurity implementation and can provide positive references for it;

demonstrable experience with supplier management and/or Third Party Risk Management;

demonstrable experience with stakeholder management at management and executive levels;

experience with governance, compliance, and risk management issues;

experience within a large public, semi-public, or socially relevant organization;

experience with tenders and contract management;

experience with contractual embedding of security and compliance requirements;

knowledge of GDPR/privacy legislation;

knowledge of the Baseline Information Security Government (BIO);

excellent advisory, communication, and change management skills.

Are you able to successfully realize an organization-wide implementation of the requirements from the Cybersecurity Law (Cbw), as the Dutch elaboration of the European NIS2 directive, within a complex public organization? Do you have experience with change processes where information security, governance, supplier management, risk management, and compliance come together? Then this is your assignment.

The Sociale Verzekeringsbank (SVB) faces the task of further strengthening its cyber resilience and complying with the requirements of the Cybersecurity Law (Cbw), the Baseline Information Security Government (BIO), and related laws and regulations. An important part of this task concerns demonstrably managing risks within the supplier chain and structurally embedding security and compliance requirements within the procurement, contract, and supplier management process. As an Interim Project Manager Cybersecurity Law (NIS2) & Third Party Risk Management, you will lead this organization-wide change task.

You will ensure that legal requirements are translated into policy, processes, governance, contracts, and control measures that are sustainably embedded within the organization. You will work closely with ICLM, CIO Office, CISO, Information Security, Privacy, Risk Management, and other involved organizational units.

This is a temporary assignment of approximately 6 to 9 months.

Additional information

When you offer a professional to us as a supplier and they are placed, we will need information from you as a contracting party, including regarding the Chain Liability Act (Wet keten- en inlenersaansprakelijkheid). The 'WKA' aims to prevent abuse in the remittance of payroll taxes at all links in the chain; from supplier to client. We design these risks for our clients by means of a blocked account, the G-account. This is an account to which part of the invoice amount is deposited and from which you can pay payroll taxes and VAT to the Tax Authorities.

The percentage to be deposited depends on whether you have a SNA certification (NEN-4400-1 or NEN-4400-2) and whether your company is established in the Netherlands or abroad. You can apply for the G-account from the Tax Authorities. If you cannot obtain a G-account (and you can provide proof of this from the Tax Authorities), you also have the option to submit an auditor's statement (assurance report regarding personnel lending) every quarter. In this, a certified accountant (AA or RA) will issue a statement about the accuracy, completeness, and timeliness of the remittances.

Well, the costs for this statement are for your own account.

Project details

• Start: 2026-11-30T23:00:00
• Location: Amstelveen Noord-Holland, NL
• Languages: Dutch