Senior Phishing Simulation Specialist

About the role

ING Hubs Spain is looking for a Senior Phishing Simulation Specialist to join the Tribe Cyber Threat Management (CTM) team, part of the Global CISO Office. The team strengthens ING's resilience against current and emerging threats through hands-on, globally collaborative work. You will manage and run ING's global social engineering simulation programme, including the global phishing simulation programme, safely testing how employees, teams and business processes recognise, report and respond to social engineering threats.

Key responsibilities

• Plan, govern, run and continuously improve a risk-based global social engineering simulation programme, covering global and targeted simulations.
• Own the full lifecycle of phishing campaigns: scenario development, targeting, stakeholder coordination, technical preparation, quality assurance, scheduling, incident handling and reporting.
• Turn threat intelligence and observed attack patterns into realistic, safe scenarios, and extend simulations beyond email (telephone, messaging, collaboration tools, QR codes, physical approaches).
• Run and improve simulation platforms and infrastructure, including templates, sending domains, landing pages, reporting and data integrations, while protecting systems and data from misuse.
• Define behavioural resilience metrics beyond click rates, identify trends across countries, business units, roles and channels, and build dashboards.
• Turn results into recommendations for security awareness teams, local CISOs, business leaders and control owners, and support follow-up communications, learning, process changes and technical controls.
• Coordinate with privacy, legal, compliance, HR, communications, technology and local CISO organisations, and ensure simulations respect local laws, labour, culture, accessibility and employee well-being.

Required profile

• At least 5 years of relevant experience in cybersecurity, phishing simulation, social engineering testing, security awareness, threat-led testing or a comparable field.
• Demonstrable hands-on experience running phishing simulation campaigns at scale with enterprise phishing or human-risk management platforms.
• Strong programme management and stakeholder engagement skills, with an understanding of privacy, ethics and employee relations in a regulated, multinational setting.
• Strong written and verbal communication skills and fluency in English; a collaborative, non-blaming approach and a continuous-improvement mindset.
• Experience with other simulation channels, behavioural change, data analysis, automation or scripting is a plus.

Required skills

• Social engineering techniques and email technologies, including sender authentication, mail routing, secure email gateways, URL protection, browser controls and reporting.
• Translating threat intelligence into safe scenarios and analysing campaign data into risk insights.

What we offer

• Flexible working: choose which days you work from home and which you come to ING MAD.
• Restaurant card, health and life insurance for you and your family, and a pension plan after 1 month.
• Flexible remuneration model with extra services such as nursery, transport card and training aids.
• Transport allowance and an office with electric mobility solutions, doctor, hairdresser, gym and errand help.