Domain Expert III - Security Testing

Cyber threats are evolving rapidly. Attackers increasingly use automation and AI, regulation raises the bar for security testing, and traditional periodic testing alone is no longer enough.
As Domain Expert Security Testing, you lead the development of our security testing capability within our Security Assurance team. You provide functional and technical leadership across penetration testing, red teaming, coordinated vulnerability disclosure and regulatory security testing, including DORA/TLPT.
Your goal is simple: make sure we continuously challenge our security and know whether our defences actually work.

As Domain Expert Security Testing, you are the functional and technical lead for the Security Testing domain. You set the direction for how we test and validate the security of the bank and ensure our capabilities evolve with changes in technology, threats and regulation.
You work with experienced offensive security specialists and provide direction on methodologies, capabilities and complex testing activities. You help determine where expert-led testing provides the most value and where automation, continuous validation and AI can make us faster and more effective.
Security Testing is also an important part of our journey towards Continuous Threat Exposure Management (CTEM). Rather than looking at vulnerabilities in isolation, we increasingly want to understand whether exposures can actually be exploited, how they can be combined into attack paths and what they mean for the bank.
You therefore connect offensive security expertise with the broader exposure management strategy.

You will:

• Lead the further development of penetration testing, red teaming and coordinated vulnerability disclosure capabilities.
• Drive security testing focused on the exposures that matter most.
• Provide expert direction for complex and high-impact security testing engagements.
• Drive the integration of Security Testing and exposure validation into CTEM.
• Explore and implement opportunities for continuous, automated and AI-assisted security testing.
• Raise the technical bar by challenging, coaching and connecting security specialists.
• Ensure regulatory requirements such as DORA/TLPT are translated into effective testing capabilities.
• Improve methodologies, standards, tooling and ways of working.
• Challenge and guide external security testing partners.
• Translate technical outcomes into actionable insights for our stakeholders.
• Identify capability gaps and turn them into concrete improvements.

You will be part of the Security Assurance team within the Corporate Information Security Office (CISO) of ABN AMRO in the Netherlands.

As Security Assurance team we identify, understand and validate cyber exposure across the bank. Security Testing brings together specialists with deep expertise in offensive security. The environment is highly technical, but the impact goes beyond individual tests. Our ambition is to move from predominantly periodic security testing towards a more continuous model of exposure validation.
You work closely with the Product Owner and Expert Lead, each with a distinct responsibility. The Product Owner determines priorities and ensures the team focuses on the work that delivers the most value. The Expert Lead creates the environment in which people and teams can perform and develop. As Domain Expert, you own the functional and technical direction: what good Security Testing looks like, how our capabilities should evolve and what expertise we need to stay ahead.

Together, you turn strategy into execution.

Must have:

• Have extensive experience in penetration testing, red teaming, coordinated vulnerability disclosure or another offensive security discipline.
• Understand modern attack techniques across applications, infrastructure, cloud and identity environments.
• Can think beyond individual vulnerabilities and reason about attack paths and real-world exploitability.
• Have experience developing security testing methodologies or capabilities.
• Can provide technical leadership without needing to be the person performing every test yourself.
• Are comfortable challenging experienced specialists and senior stakeholders.
• Understand how automation and AI are changing both offensive security and security testing.
• Can translate complex technical subjects into clear decisions and priorities.

Nice to have:

• Understand regulatory security testing; experience with DORA/TLPT.
• Experience with product ownership in an agile working…