Careers
Build your career in cybersecurity engineering.
ITTCsec is a remote-first cybersecurity engineering practice based in Utrecht, Netherlands, working with organisations across the Netherlands and Europe. We're small, direct, and not interested in pretending otherwise. This page describes how we actually work, not a recruiting brochure version of it.
Working at ITTCsec
ITTCsec exists to close the gap between knowing about a security problem and actually having it fixed. Working here means working directly on that gap: with clients, with real environments, and with the engineers who do the work, not through layers of account management. We combine Security Engineering, Cloud & Infrastructure Security, Software Security, Identity Security, Cyber Risk and AI Security into one practice, which means the work itself tends to be varied rather than narrowly specialised from day one.
Remote-first & flexible working
Remote work is the standard, not the exception. Most engineering, assessment work, client calls and internal collaboration happen remotely by design. Occasional on-site attendance comes up for specific, genuine reasons (a client engagement that calls for a physical presence, a workshop, a hands-on security project, or team collaboration that's easier done in person), and gets arranged around those, rather than a blanket in-office expectation.
Utrecht is home base, and the Netherlands is our primary commercial market. From there we take on engagements across Europe where the work calls for it, delivered remotely with travel arranged when an assessment or workshop genuinely needs it, the same way we work with clients.
Culture and values
Engineering before theatre
We focus on controls that work in real environments, not ones that look complete in a slide deck, and that standard applies to how we work internally too.
Say what we don't know
If something is outside our expertise, we say so. Credibility comes from being right, not from sounding certain, and that goes for clients and colleagues alike.
Plain language, real technical depth
Findings and recommendations should be usable by both the engineer implementing them and the executive funding them. We write and talk accordingly.
Direct exposure, not gatekept work
You work directly with clients and the actual engineering problems, not a filtered version of them handed down through account managers.
Learning and professional development
The work itself is the main way people grow here. Because the practice spans identity, cloud, software, infrastructure, risk and AI security rather than one narrow speciality, engagements regularly cross into adjacent areas, which means more exposure to different problems than a role scoped to a single narrow domain would give you. Expertise isn't gatekept internally: if you're curious about a part of the practice you haven't worked in yet, that's a conversation worth having, not a lane you have to stay in.
Benefits and flexibility
Being remote-first extends to how work is structured day to day: flexibility in how and when work gets done, rather than a fixed model applied uniformly regardless of the engagement. Specific compensation and working arrangements are discussed individually, based on the role and the person. We'd rather have that conversation directly with you than publish generic figures that don't reflect it.
Current opportunities
No open roles listed right now
We're a small, engineering-led practice, and we're not going to pretend there's a long list of open roles when there isn't. If we do have a specific opening, it will be described here honestly, with a real scope and real requirements. In the meantime, experienced security engineers, consultants and researchers are welcome to reach out speculatively below.
Internship & graduate opportunities
We don't run a formal, structured internship or graduate programme today. That's an honest limitation of being a small practice, not a closed door. Students and recent graduates with genuine interest in security engineering and some demonstrable ability (personal projects, coursework, CTF participation, anything that shows real curiosity) are welcome to send an open application. If there's a fit, we'll figure out what that looks like together rather than fitting you into a track that doesn't exist yet.
Open applications
Send a short, specific note (what you're good at, what kind of work you're looking for, and why ITTCsec specifically) along with your CV or LinkedIn profile to hr@ittcsec.com. You can also follow ITTCsec on LinkedIn for updates.
Recruitment process
Direct, without unnecessary rounds. It typically looks like an initial conversation about your background and what you're looking for, a more technical or practical conversation with the person you'd actually work with, and a final conversation to confirm it's a good fit on both sides. No assessment centres, no week-long take-home projects. The goal is to actually get to know each other, not to run a process for its own sake.
Equal opportunity
ITTCsec evaluates candidates on ability, experience and fit for the work, regardless of age, gender, gender identity, sexual orientation, disability, religion, ethnicity, nationality, or any other characteristic unrelated to the role. If you need a reasonable accommodation at any stage of the process, say so, and we'll work with you on it.
Frequently asked questions
Is remote work really standard, or is it mostly for show?
It's standard. Most day-to-day work (engineering, assessments, client calls, internal collaboration) happens remotely. On-site time comes up for specific reasons: a client engagement that needs a physical presence, a workshop, a hands-on security project, or team collaboration that's genuinely easier in person. It's the exception that gets scheduled, not the default.
Do I need to already live in the Netherlands?
Being based in or near the Netherlands makes on-site client work and in-person team time easier to arrange, since Utrecht is our base and the Netherlands is our primary market. That said, get in touch even if you're not: what matters most is whether the work and the arrangement genuinely fit.
Do you have a structured internship or graduate programme?
Not a formal one today. We're a small, engineering-led practice without a dedicated graduate track. That doesn't mean the door's closed: if you're a student or recent graduate with genuine interest and some demonstrable ability, we're open to hearing from you through an open application.
I don't see an open role that matches me. Should I still reach out?
Yes. We don't keep a long list of open positions running just to look active, so most people who end up working with us reach out before a specific role is posted. A short, specific note about what you're good at and what you're looking for goes a long way.
What does the interview process actually look like?
Direct, without unnecessary rounds. Typically: an initial conversation about your background and what you're looking for, a more technical or practical conversation with the person you'd actually work with, and a final conversation to make sure it's a good fit on both sides. We don't run assessment centres or week-long take-home projects.