This year the payment page of a large Dutch government organisation sent payment data to an American company that analyses website visits. Nobody meant it to. A standard tracking script sat on the site, a piece of code that measures what visitors do, including on the pages where citizens pay. An ethical hacker spotted it, the organisation itself did not. It became a data breach, reported to the Dutch Data Protection Authority.
No break-in was involved, no stolen password, no ransomware. A technical team did its job, and nobody in the team or at the supplier asked what may run on a payment page.
The leak is rarely in the firewall
You see this more often this year. At a telecom provider, someone posing as helpdesk staff called a colleague and got a password plus the login code. At a logistics company, data on customers of web shops and banks may have leaked along with it. If your customer is at risk, so are you.
The largest annual study of data breaches (Verizon DBIR 2026) sees the same. 31% of breaches start with the exploitation of a known software vulnerability, more often than with stolen credentials. Closing such a hole is the work of system administrators and engineers. The security team only sees it when it is too late.
What a control is
A control is an agreement you can show works: who may log in where, how fast an update must be applied, who reviews a change before it goes live. In the Netherlands that is tested in three ways.
ISO 27001 is a certificate for the way an organisation manages security. Many companies start there.
SOC 2 is an American standard in which an auditor tests whether the measures actually work. Type I looks at a single day, Type II at six months or more. In the Netherlands such a report is usually an ISAE 3000 assurance report, signed by a registered IT auditor. A Type II audit looks at what engineers really did for half a year: every change, every access, every update.
The Dutch Cybersecurity Act (Cyberbeveiligingswet) has applied since 15 August 2026. It is the Dutch version of the European NIS2 directive. Thousands of organisations are now legally required to have their security in order, and their board must approve the measures itself.
Four profiles that are worth more because of it
The developer who knows which data leaves a page, and asks before another company's script is added.
The cloud engineer or system administrator who tracks who can access what and whether everything has the latest update, as if the auditor were watching. In a Type II audit you have to be able to show it.
The consultant who works out what the auditor found and turns it into a task list for the team.
And the security engineer, who is still needed. But cannot do this alone.
How you hear it in an interview
Do not ask whether the candidate knows ISO 27001. Everyone says yes. Ask what happened:
- 'What did you do the last time a change had to go live outside the normal process?'
- 'Who had access to production at your previous employer, and how did you know?'
- 'Which audit finding did you resolve yourself?'
A strong answer is about a ticket, an approval, a log. A weak answer is about speed.
Where the competition is
Since 15 August, thousands of organisations are hiring at the same time, because the same law applies to them. If you only look at the title security engineer, you compete with all of them for a small group. If you look at knowledge of controls, you see a larger group: developers, administrators and consultants who already work the way an auditor wants.
Pearson & Partners locates and qualifies engineers, administrators and consultants who can already do this. More on the cybersecurity field.
Sources: Dutch parliamentary questions 2026Z11812 and answers of 25 June 2026; Verizon Data Breach Investigations Report 2026; Cyberbeveiligingswet, Stb. 2026, 187; NOREA on ISAE 3000.