Dutch hospitals hold some of the most sensitive data in the country, and recent attacks on healthcare software suppliers have shown how quickly a breach elsewhere can reach the bedside. The six CISOs below protect academic medical centers, a specialist cancer institute, and regional hospitals, and their paths into security could hardly be more varied. One co-founded one of the Netherlands’ first online used bookstores and later advised a minister on lawful interception. Another spent 15 years as a systems administrator before cutting his hospital’s connection to a hacked supplier the day the news broke. A third designed security for a government remote voting project, and a fourth spent two decades in sales leadership at ING, Dun & Bradstreet, and Versatel before becoming a hospital CISO.
Sander Vols – CISO, Radboudumc
Sander Vols co-founded one of the first online used bookstores in the Netherlands in 2001, drawing around 500 visitors a day, and later co-founded the Centre for Public Order and Safety at the University of Groningen. He moved into government at the Radiocommunications Agency, rising from legal counsel to senior advisor on inspection policy for lawful interception, data retention, and cybersecurity. As senior policy officer for telecom at the Ministry of Economic Affairs, he advised the minister on intelligence services, lawful interception, and encryption, and worked on implementing the NIS Directive in Dutch law, while also serving as special advisor to the Minister of the Interior on revising the constitutional secrecy of correspondence. After consulting on cybersecurity and privacy at Verdonck, Klooster & Associates, Vols became CISO of Radboudumc in November 2020. He chaired the participant council of Z-CERT, the healthcare sector’s cybersecurity center, from 2023 to 2025, and was named to the 2025 Dutch CISO Top 100.
Ivo van Heeren – CISO, Elisabeth-TweeSteden Ziekenhuis
Ivo van Heeren spent 15 years as a senior systems and network administrator at De Riethorst Stromenland before moving into privacy and security at Mijzo, first as data protection officer and then as information security officer. He became CISO of Elisabeth-TweeSteden Ziekenhuis in Tilburg in March 2023. When news of the ChipSoft hack broke in April 2026, ETZ cut its connection to the ChipSoft care platform the same day, switching to phone calls and secure email to exchange patient information with other hospitals. Van Heeren has explained publicly that ETZ keeps its patient records in its own data center, limits access to staff who need it for their work, and relies on layered email defenses and mandatory staff training, while being candid that no hospital system is ever completely secure.
Sander Moonen – CISO, Jeroen Bosch Ziekenhuis
Sander Moonen spent five years as an information security researcher at TNO Defence, Security and Safety, working on penetration testing, cryptography, critical infrastructure, and computer network defense for the Ministry of Defence. At ABN AMRO he managed vendor security delivery and then identity and access management, and at grid operator Enexis he led security and privacy for smart meters and implemented a security operations center. As CISO of Koninklijke Kentalis, he built a complete information security organization for certification and cyber defense across its healthcare, education, and academic operations, achieving NEN 7510 and ISO 27001 alignment. After a year as CISO of Stichting Philadelphia Zorg, Moonen became CISO of Jeroen Bosch Ziekenhuis in ‘s-Hertogenbosch in October 2024. He holds the CISM certification.
Sander Kruese – CISO, Gelre ziekenhuizen
Sander Kruese started as a systems administrator at Wegener and spent several years as an ICT consultant at LogicaCMG, designing the internet security for the Ministry of the Interior’s remote voting project and the security of a new workplace for 35,000 Tax Administration staff. He served as security architect and officer for the Dutch Ministry of Defence’s command and control systems, guiding new military systems through accreditation, and represented the Netherlands in the Multilateral Interoperability Programme. After security and risk roles at Achmea, he spent more than six years as corporate privacy and security advisor at grid operator Alliander, managing its part in the EU SEGRID smart grid security project and sitting on the European Utility Week advisory board. Kruese served as CISO and data protection officer of Deventer Ziekenhuis before becoming CISO of Gelre ziekenhuizen in January 2025. He was named to the 2025 Dutch CISO Top 100.
Eva Hoek – CISO, Antoni van Leeuwenhoek
Eva Hoek began her career through an IT traineeship at Achmea, working as a business analyst and then IT security specialist. She advised on information security at the Authority for Nuclear Safety and Radiation Protection before joining the Antoni van Leeuwenhoek, the Netherlands Cancer Institute, in 2018 as information security and privacy officer. After serving as interim CISO, Hoek became CISO in December 2024, protecting patient records alongside highly confidential oncology research at one of the country’s leading cancer treatment and research centers. She has been featured on the Dutch CISO Top 100 list.
Sybren Henstra – CISO, Spaarne Gasthuis
Sybren Henstra spent two decades in sales and commercial leadership, starting at Kuwait Petroleum and Versatel before managing payments relationships with financial institutions across Asia, the Middle East, and Central and Eastern Europe as a VP at ING. He went on to serve as sales and marketing director for Dun & Bradstreet in the Netherlands and in sales leadership at Delta and MaxGrip. He moved into privacy and security in 2017 as interim data protection officer at Careyn, then served as CISO and privacy officer at Diakonessenhuis. Henstra became CISO of Spaarne Gasthuis in May 2021 and has chaired the CISO network of the Dutch Hospital Association since 2022.
Security at the Bedside
These six CISOs show how many paths lead into hospital security. Vols brought policy and legal expertise from government, while Moonen and Kruese carried defense, banking, and utility experience into healthcare. Van Heeren and Hoek grew into the role from systems administration and privacy, and Henstra applied years of commercial leadership to a new field. Together they protect the patient data and clinical systems that Dutch hospitals rely on every day.
Discover more CISOs securing their organizations:
-
- Public Service, Protected: New Zealand’s Government CISOs to Watch
- Power and Water: Denmark’s Energy and Utilities CISOs to Watch
- Chemistry and Code: Germany’s Chemicals Manufacturing CISOs to Watch
- From Piazza Affari to Payments: Italy’s Financial Services CISOs to Watch
- Iron and Code: Machinery Manufacturing’s CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.