At ING Hubs Spain we are looking for a Senior Phishing Simulation Specialist

Your role and work environment:

We are looking for a talented and enthusiastic Senior Phishing Simulation Specialist to join our highly specialised and multicultural team within the Tribe Cyber Threat Management (CTM), part of the Global CISO Office.

The responsibility of this team is to strengthen ING's resilience against current and emerging threats through a hands-on approach, and our way of working is based on global collaboration, responsible testing, knowledge sharing and the Orange Behaviours.

In this role, you will manage and execute ING’s global social engineering simulation programme, including the global phishing simulation programme. Your mission will be to safely test and improve how employees, teams and business processes recognise, report and respond to social engineering threats.

This is not a traditional security awareness or communications role. We are looking for a hands-on specialist who can run a global programme, develop credible scenarios, operate simulation technology, coordinate stakeholders, analyse behavioural data and turn results into measurable improvements without creating a culture of blame.

Your key responsibilities:

As a Senior Social Engineering Simulation Specialist you will:

- Manage the planning, governance, execution and continuous improvement of a risk-based global social engineering simulation programme, covering both integral and targeted simulations.
- Own the full lifecycle of global and targeted phishing simulation campaigns, including scenario development, targeting, stakeholder coordination, technical preparation, quality assurance, scheduling, incident handling and reporting.
- Co-create realistic,



threat-informed scenarios by translating relevant threat intelligence and observed attack patterns into safe and credible simulations.
- Develop, where appropriate, simulations across channels beyond email, such as telephone, messaging, collaboration tools, QR codes or physical approaches, with clear objectives, approvals, boundaries and safeguards.
- Operate and continuously improve simulation platforms and supporting infrastructure, including templates, sending domains, landing pages, reporting mechanisms, user targeting and data integrations.
- Ensure deliverability and technical performance, troubleshoot operational issues, and protect simulation systems and data from misuse.
- Define and analyse meaningful behavioural resilience metrics that go beyond click rates, including recognition, reporting and response behaviour.
- Identify trends across countries, business units, roles, channels and scenario types, and develop dashboards that highlight exposure and opportunities for improvement.
- Translate simulation outcomes into clear recommendations for security awareness teams, local CISOs, business leaders and control owners.
- Support targeted communications, learning activities, process changes, technical controls and follow-up simulations, assessing whether interventions improve resilience over time.
- Coordinate planning and approvals with privacy, legal, compliance,



human resources, communications, technology and local CISO organisations.
- Ensure simulations account for local legal, labour, cultural, accessibility and employee well-being considerations, and present balanced and actionable insights to leadership.

What are we looking for?

Want to know if this job is made for you? These are some of the qualities that we value the most for this role.

- At least 5 years of relevant experience in cybersecurity, phishing simulation, social engineering testing, security awareness, threat-led testing or a comparable field.
- Demonstrable hands-on experience managing and executing phishing simulation campaigns at scale using enterprise phishing simulation or human-risk management platforms.
- Experience translating threat intelligence into safe, realistic scenarios and analysing campaign data to produce meaningful risk insights and recommendations.
- Strong programme management and stakeholder engagement skills, with an understanding of the privacy, ethical, cultural and employee-relations considerations associated with simulations in a regulated, multinational environment.
- A strong sense of ownership, with the ability to manage multiple activities, resolve operational issues, coordinate dependencies and follow through from planning to measurable improvement.
- A collaborative and constructive approach focused on helping employees and teams become more resilient rather than assigning blame.
- A continuous-improvement mindset and the ability to stay ahead of the evolving social engineering threat landscape.
- Strong written and verbal communication skills and fluency in English.
- Experience with

📌 Senior Phishing Simulation Specialist (Madrid)
🏢 ING Hubs Spain
📍 Madrid