The Dutch Cybersecurity Act pulls more than 8,000 organizations into scope at the same moment. Cybersecurity hiring now means competing for the same experienced people, mostly in governance, incident response and cloud security. Hiring managers who adjust their search early will fill these roles faster.

The law has been in force since 15 August 2026 and implements the EU's NIS2 Directive. It affects food, healthcare, banking, energy, transport and more. If you hire security people, expect longer searches and sharper requirements. If you are a security professional, expect more conversations, and more of them from companies you have never heard of.

It turns cybersecurity into a management responsibility, with deadlines that need people on the payroll. Organizations must report serious incidents within 24 hours and send an update within 72 hours. That only works with trained staff who can act on incomplete information.

According to the Dutch government's NIS2 information, more than 8,000 organizations fall under the act. Directors can be held personally accountable if the basics are not in place, as NOS reported after a major retail incident.

The law also came in without a transition period. Nobody got a phased window to build a team.

"Zo'n 8.000 organisaties moeten tegelijkertijd aan complianceverplichtingen voldoen, allemaal concurrerend om dezelfde beperkte groep beschikbare specialisten." Amir Jalali, a recruiter at a staffing firm, via Consultancy.nl

The pressure lands on roles that connect regulation to daily operations. That means governance and compliance specialists, incident-response managers, cloud-security engineers and security leaders. The common thread is evidence: companies need people who can show that controls work.

Here is how the demand looks from where we sit as recruiters:

• CISOs and security directors, who set risk levels and brief the board.
• GRC specialists, who turn NIS2 requirements into policies and proof.
• Incident-response managers, who handle the 24-hour clock.
• Cloud-security engineers and security architects, for retailers, banks and logistics firms on cloud platforms.
• Identity and access specialists, for strong authentication and privileged access.
• Supplier-risk managers, because the law reaches into the supply chain.

Operational-technology security is a smaller group, but manufacturers and food distributors need it more each year.

Experience takes years to build, and the demand now arrives all at once. A short course can grow the junior group, but it does not create someone who has run an incident at 3 a.m. and then explained it to a board.

Most strong candidates already have a job at a bank, a consultancy, a government agency or a managed-security provider. They are not browsing. They respond to recruiters who know the work.

The role has also grown wider. Employers ask for technical depth, knowledge of regulation, good communication, Dutch and crisis leadership in one person. That profile exists, but rarely.

We went deeper into this in our piece on the cybersecurity talent shortage as a hiring problem. The short version: the shortage is real, but a lot of it comes from how roles are written.

Yes. Requiring Dutch shrinks an already small group of candidates, especially in Amsterdam. Emerce reported that this requirement narrows the available pool further, and Jalali said the same.

Sometimes Dutch is truly needed. A role that talks daily with regulators or works shifts with Dutch-speaking operators is one example. For many other roles, it is a habit rather than a need. A GRC specialist who writes policy in English can work well in a team that speaks Dutch at lunch.

A practical test helps. Ask which tasks in the first six months really need Dutch. If the list is short, consider English-speaking candidates, remote work or cross-border hires. The research suggests more employers will have to, though I can't say yet how many will.

For the Dutch market in general, our overview of cybersecurity hiring in the Netherlands covers what we see in 2026.

Start with a clear intake and a realistic profile. Split the unicorn role into two or three parts, and decide which part you hire, which you rent and which you outsource. Then move fast with candidates, because good ones get several offers.

Here is a mini example of how this can look. A mid-sized manufacturer asks for one person who is CISO, GRC lead and incident manager. After the intake, the role turns into a security lead hire plus a fractional GRC specialist, with SOC monitoring bought from a provider. The search for the lead is narrower, so interviews start sooner.

In our Delivery Sprint, the intake decides most of the outcome. We agree on must-haves, nice-to-haves and what the role looks like after a year. Candidates see the same picture, so they know what they are saying yes to.

Expect higher pay too. Competition will push up salaries, contractor rates and fees for the scarcest roles. Public-sector and regional employers feel this most, because they cannot always match banks.

More choice, but also more responsibility. Senior hires may sign off on risk, lead incidents under time pressure and explain failures to regulators. Pay does not always match that liability.

If you are weighing offers, ask who the role reports to, whether the board funds security and how incidents were handled in the past. Those answers tell you more than the job title.

Companies that take this seriously will say it plainly. Companies that only want a name on a compliance document will not. That is useful to know before you accept.

The Dutch cyber law did not create the need for security people. It made the need urgent, and it made it urgent for thousands of companies at once. Governance, incident response and cloud security roles will take the most pressure.

For hiring managers, the best move is a tighter role, a more flexible view on language and location, and a process that does not stall. For security professionals, it is a good moment to be picky about who you work for.

If you are building or joining a security team and want to compare notes on the market, we are happy to talk it through.

1. AH moest hack melden vanwege nieuwe cyberwet: 'Verantwoordelijkheid reikt verder'
2. NIS2 Directive (Cyberbeveiligingswet, Cbw)
3. Meer vraag, minder flexibiliteit: het Nederlandse ...
4. Cyberbeveiligingswet vergroot druk op toch al krappe ...
5. Dutch regulator flags EU cyber gap for cloud-controlled home batteries - pv magazine Global
6. NJB: wetgeving - staatsblad: Cyberbeveiligingswet

Written by our AI, read by a flesh-and-blood recruiter.