Most candidates look at the obvious things first:

• salary
• title
• tech stack
• remote flexibility
• brand name

That makes sense. But those things do not tell you how a company operates when things get difficult.

Security and compliance do.

If the basics are weak, you usually see the same pattern:

• teams spend more time fixing than building
• audits create chaos instead of structure
• ownership is vague
• access and data rules are inconsistent
• pressure lands on delivery teams when something goes wrong

That kind of environment wears people down quickly. You join for growth and decent engineering work, then end up cleaning up things that should have been sorted long before.

Most companies will not openly admit they are underprepared. You pick it up in smaller signals.

Watch for things like these:

• nobody can clearly explain who owns security
• compliance only comes up around audits or client pressure
• leadership talks constantly about speed, but rarely about resilience
• documentation is patchy or depends on who you ask
• incident response sounds vague or improvised
• security is described as “everyone’s responsibility” with no real structure behind it

None of this automatically means a company is badly run. But it often means the foundations are weaker than they look from the outside.

And once you are inside, that becomes very obvious.

The stronger companies are usually not the loudest about it.

They just have the basics in place.

That tends to look like:

• clear ownership across engineering, platform and security
• sensible access controls and governance
• compliance that is part of normal operations, not last-minute panic
• teams that can explain how incidents are handled
• leaders who care about delivery and operational discipline
• a working culture where issues are addressed early, not buried

For candidates, that usually means a better working environment. Less scrambling. Less blame-shifting. More room to do proper work.

Dutch tech candidates, especially in fintech, cloud and platform-heavy businesses, are becoming more selective.

That is not only because the market is competitive. It is also because more people have seen what happens inside companies that look polished from the outside but run on patchwork internally.

In fintech, weak controls do not stay hidden for long. Clients ask harder questions. Regulators expect discipline. Trust matters.

So candidates are starting to look beyond the pitch. They are asking:

• Is this company actually well run?
• Are the basics in place?
• Will I be building something solid, or walking into avoidable mess?

Those are fair questions.

You do not need to interrogate anyone. But you do need to ask better questions.

A few useful ones:

• How is security ownership divided internally?
• What happens when there is an incident?
• How mature are your compliance processes today?
• What has improved in the last 12 months?
• Where are the gaps you are still working on?

The answers matter, but the way they answer matters too.

Strong companies are usually clear. Weak ones tend to stay broad and vague.

That is often your clue.

Security and compliance failure is not just a company risk. It becomes a people problem very quickly.

For candidates, that affects workload, stress, trust, and the kind of experience you actually gain.

So before joining your next company, especially in Dutch fintech or tech, look past the pitch.

Ask yourself one simple question: Is this business built properly, or just presented well?

Because the answer will tell you a lot about what it will actually feel like to work there.