Senior Consultant in Cyber & Digital Law

Brussels or Antwerp · Hybrid · No bar admission required

When a client is hit by ransomware at 2 a.m., someone has to bring order to the chaos. That means getting

forensics moving, mapping the reporting deadlines, briefing the board and handling the insurer. At CMS

Belgium, that someone could be you.

Our market-leading Technology, Media & Communications practice is looking for a Senior Consultant to join

its cyber and digital regulatory team. This role is for a legal professional who is as curious about how systems

get breached as about what the law requires afterwards. You will work alongside our lawyers, but you don’t

need to be at the bar. We welcome people from law firms, consultancies, in-house legal or compliance teams,

regulators and public authorities.

One role, two sides

When an incident hits, you are the calm, structured point of contact for clients in crisis. You will:

• lead intake and scoping, run status meetings and act as the liaison with cyber insurers

• coordinate forensic investigators, IT and security providers, insurers, brokers and crisis communications

advisers

• assess reporting obligations under GDPR, the Belgian NIS2 Law, DORA and sectoral rules, and keep every

deadline on track

• draft notifications to the DPA, the CCB and sectoral supervisors, as well as communications to data

subjects, customers and partners

• support decision-making in extortion scenarios, including the sanctions questions around payment

• run post-incident reviews and turn the lessons into concrete improvements

Between incidents, you help clients get ready and stay compliant. You will:

• advise on GDPR and Belgian data protection: governance, DPIAs, international transfers, data subject rights

and vendor management

• scope NIS2, CyberFundamentals, DORA and Cyber Resilience Act compliance through gap analyses and

roadmaps

• advise on the AI Act, Data Act, Data Governance Act, DSA/DMA, eIDAS, and cloud and outsourcing rules

• draft and negotiate DPAs, security schedules, SLAs and incident cooperation clauses

• build incident response plans, playbooks and tabletop exercises, and train legal, IT and executive teams

• write guidance, speak at webinars and sector events, and help grow the practice and its retainer offering

Who you are

What we need:

• a law degree (Master in Laws or equivalent) from a EU-based university

• at least 3–5 years in data protection, cybersecurity, technology or digital regulation

• a genuine interest in technology: you like understanding how things actually work and you follow the

threat landscape

• fluency in Dutch and English (French is a strong plus)

• the ability to explain legal issues clearly to CISOs, IT teams and boards, and to stay composed and discreet

under pressure

• availability for our standby rota [frequency / compensation]

What would make you stand out:

• hands-on experience with breach or incident response

• familiarity with ISO/IEC 27001, CyberFundamentals or the NIST CSF

• certifications such as CIPP/E, CIPM, CISM or CISSP (we will support you in getting them anyway)

• experience in a regulated sector: finance, healthcare, energy, telecoms or critical infrastructure

• enough technical literacy to hold your own with a forensic team (no engineering degree needed)

Don’t tick every box? Apply anyway. We care more about curiosity and judgment than a perfect checklist.

What you get

• a senior, visible role with real ownership of matters and direct client contact from day one, and a clear path

to a leading role in the cyber practice

• work where law, technology and crisis management meet, where no two incidents are the same

• the reach of the CMS network: 7,400+ lawyers in 50+ countries, cross-border matters and secondment opportunities

• Competitive remuneration plus bonus, with an annual review

• a structured development path, with your certifications funded

• hybrid working and real flexibility, with offices in Brussels and Antwerp

• a collegial, non-hierarchical team that takes the work seriously without taking itself too seriously

• international CMS events, trainings, well-being programmes and sports activities

How it works

The process has three steps: an introductory conversation, an interview with the practice leadership including

a short case discussion, and a final meeting with the team.

Want to talk first? Camille Vanhelleputte (HR) is happy to have an informal, confidential chat: hr@cms-db.com

· +32 2 743 69 28.