Key Skills

Job Description

How do you make our customers happy? By making security part of how bol thinks, builds and operates. You own and evolve our company-wide security culture strategy, helping colleagues, leaders and engineers make better security decisions every day. You turn human cyber risk into a meaningful foundation through behavioural insight, technical credibility, sharp prioritisation and communication that people actually remember. The result is that security becomes less of a mandatory checkbox and more of a natural part of how we innovate and serve millions of customers and partners. The biggest challenge Security matters to everyone, but it is rarely the first thing people wake up thinking about. Your challenge is to create lasting behavioural change across a fast-moving retail tech organisation with thousands of colleagues, many different audiences and constantly evolving threats. How do you make secure behaviour the easiest choice for an engineer deploying code, a leader weighing a business decision or a colleague experimenting with AI? You need to stand out among competing priorities and prove that your interventions genuinely reduce risk. This requires maintain and create one coherent culture without pretending that every audience needs the same message. What You Do As Lead Cyber Security Culture You own security culture as a domain, not simply a calendar of campaigns. You set the strategy and maturity roadmap, translate security and business risks into behavioural priorities, and create measurable interventions that work across bol. In this role, you are the recognised expert and sparring partner for teams across Security, Product, Tech & Data, Risk, People&, Internal Communications and senior leadership. You combine strategic ownership with a willingness to build and test, whether you are advising leaders on a behavioural risk trend, redesigning a learning path for engineers, or testing a new nudge that makes secure behaviour easier. You use data to learn what works, stop what does not and scale the approaches that make a difference. Own and evolve bol’s security culture strategy, maturity roadmap and priorities. Define behavioural outcomes, KPIs and reporting that show whether initiatives reduce human cyber risk. Identify emerging security, technology and regulatory developments and translate them into relevant action for bol. Advise senior stakeholders on security culture trends, behavioural risks and effective interventions. Design and lead cross-company initiatives that embed secure behaviour throughout employee and engineering journeys. Drive adoption of secure engineering practices through targeted learning paths, technical workshops and a strong Security Champions community. Build organisation-wide capability for secure and responsible use of AI, supported by meaningful effectiveness measures. Ensure awareness and culture initiatives contribute to relevant compliance objectives, including NIS2 and DORA. Experiment with behavioural science, data and new learning formats, then use evidence to improve and scale them. Connect security specialists with the wider organisation and make complex topics clear without sanding off all the important edges. Why you can make a difference In this role, you get the space to develop a clear vision and bring colleagues along with you. You help us achieve a stronger security posture by bringing deep experience in security awareness, security culture, human risk management or a closely related cyber security domain. You set direction independently and turn an ambiguous domain into a clear strategy, roadmap and measurable outcomes. Because you understand cyber security well enough to challenge specialists and support engineers, you easily translate technical and regulatory risk into useful action. You influence across teams and levels without relying on formal authority, using evidence-based arguments that are adapted to the audience. You are comfortable combining behavioural change, communication, learning design and data, knowing that completion rates alone do not prove impact. You spot relevant trends, experiment with new approaches and share what you learn, including when an experiment flops spectacularly. You communicate confidently in Dutch and English and can make complicated subjects clear, engaging and actionable. Where you'll be working You join a large security organisation with plenty of expertise and room for your own ideas. Your scope spans bol: from colleagues taking their first steps in the organisation to engineers, senior managers and security specialists. Existing partners and learning solutions give you a foundation, while the domain ownership gives you the freedom and responsibility to decide what should evolve next. You will help build a security culture that supports how bol serves its customers, works with partners and keeps reinventing retail. Something for you? Strategic domain owner: You get energy from setting direction independently and turning an ambiguous domain into a clear strategy and roadmap. Technical translator: You love translating complex technical and regulatory risks into useful, actionable steps for diverse audiences. Evidence-based experimenter: You enjoy combining behavioural science, communication and data to test new approaches and measure real impact. Nothing for you? Predictability seeker: You prefer working with fixed, pre-defined campaigns rather than building and evolving a strategy from scratch. Silo worker: You prefer working in isolation rather than collaborating closely with Security, Product, Tech & Data, Risk, People& and senior leadership. Output over outcome: You focus on tracking simple completion rates rather than measuring actual behavioural change and risk reduction. We take pride in our B Corp certification and strive for continuous improvement every day. Our annual bonus is tied to sustainability goals, and we are committed to equality and equal opportunities for all.Perks of having a blue heart 29 days: to recharge Travel costs: Public transport, car, parking & charging covered Pension plan: 75% premium covered Annual bonus: Based on sustainability goals

Core Responsibilities

Own and evolve the company-wide security culture strategy, maturity roadmap, priorities, and measures of impact. Lead cross-company initiatives, learning programs, and experiments that embed secure behaviour, support responsible AI use, and reduce human cyber risk.

Requirements

The role calls for deep experience in security awareness, security culture, human risk management, or a related cyber security field, along with the ability to set strategy and deliver measurable outcomes. Candidates should be technically credible, able to influence stakeholders and translate complex risks into actionable guidance, use evidence to improve interventions, and communicate confidently in Dutch and English.

Benefits

• 29 Days Of Leave
• Travel Costs Covered
• Pension Plan With 75% Of The Premium Covered
• Annual Bonus Based On Sustainability Goals