Tech & SaaS

A SaaS company may fall under NIS2: cloud computing services are listed in Annex I and digital providers in Annex II. In the Netherlands NIS2 is implemented through the Cyberbeveiligingswet (Cbw), which has applied since 15 August 2026. Whether a specific company is in scope depends on the service and its size, so organisations need to check for themselves. The GDPR always applies to customer data.

A tech scale-up mainly needs DevSecOps engineers and application security specialists who build security into the development pipeline and protect APIs. With AI features in the product, demand grows for AI and LLM security consultants. Cloud security architects secure multi-cloud environments, and a DPO or privacy-by-design consultant ensures the product complies with the GDPR from the design stage.

MVPeople Group responds to every request within 4 hours and delivers introduction CVs for interim roles within 24 hours, often with a first profile within 4 hours. Candidates come from a network of more than 7,000 pre-screened cybersecurity professionals across 25 disciplines, including DevSecOps, application security and AI security. That lets a scale-up grow its security alongside its product.

Interim fits a fast build-up, such as setting up a secure development lifecycle, a first penetration test or preparing for a customer audit. Permanent hiring fits core roles that embed security in the product and the organisation. For early-career professionals MVPrentice offers traineeships, and through MVPermanent you receive CVs within 72 hours with a typical time-to-hire of 2 to 4 weeks.