Third-Party Cyber Risk Manager

Details

Eneco is seeking a senior Third-Party Risk Management professional to own and mature its end-to-end third-party cyber risk programme. The role sits within the CISO Office and works closely with Procurement, Legal, Compliance, Enterprise Risk, Data Privacy, IT, and the wider business. Eneco operates critical energy infrastructure and is directly in scope for NIS2 and DORA.

The role offers the opportunity to shape the TPRM programme, embed security into procurement and supplier governance, and make third-party cyber risk visible and manageable across the organisation.

Responsibilities

• Own the TPRM framework end to end, including policies, standards, procedures, risk registers, and playbooks.
• Lead governance forums and risk-based decision-making and risk acceptance processes.
• Define and track KPIs, KRIs, and executive dashboards for supplier risk visibility.
• Drive continuous improvement across the third-party lifecycle, from onboarding through offboarding.
• Perform and oversee security assessments of new and existing suppliers, including reviews of ISO 27001 certifications, SOC reports, penetration test results, BCDR plans, and security controls.
• Evaluate supplier cyber maturity, provide risk ratings, define remediation requirements, manage exceptions, and oversee remediation tracking.
• Implement continuous monitoring for critical suppliers and manage periodic reassessments.
• Support supplier breach response activities alongside the incident management team.
• Embed mandatory security review gates into procurement and ensure high-risk vendors are assessed and approved before onboarding.
• Support contract reviews and security clause integration with Legal and Procurement.
• Align TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR requirements.
• Prepare evidence and reporting for internal and external audits and regulatory examinations.
• Own and optimise the TPRM/GRC platform, including automation of vendor onboarding, risk tiering, workflows, and reporting.
• Identify opportunities to reduce manual effort and increase assessment coverage through tooling.
• Define reporting capabilities that translate supplier risk data into actionable management insight.

Requirements

• 5+ years of hands-on experience in Third-Party Risk Management.
• 7+ years of experience in Cyber Security, IT Risk, Information Security, or GRC.
• Proven experience leading or maturing a TPRM programme in a large enterprise.
• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes.
• Experience with critical infrastructure or regulated-sector environments is advantageous.
• Deep understanding of vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management.
• Strong knowledge of NIS2, DORA, ISO 27001, NIST CSF, and GDPR.
• Hands-on experience with at least one GRC or TPRM platform, such as ServiceNow GRC, OneTrust, Archer, ProcessUnity, or a similar platform.
• Solid grounding in cloud security, identity and access management, incident management, and business continuity and disaster recovery (BCDR).
• Strong ownership, analytical, data-driven, collaborative, and automation-oriented mindset.
• Ability to communicate risk clearly to senior stakeholders and translate complexity into decisions.
• Ability to influence Legal, Procurement, Risk, IT, and business stakeholders without formal authority.

Preferred certifications include CISSP, CISM, CRISC, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, or Certified Third Party Risk Professional (CTPRP).

Benefits

• Gross annual salary of €72,000 to €90,100, including FlexBudget and 8% holiday allowance; a bonus or collective profit sharing may also apply depending on the role.
• Flexible FlexBudget that can be paid out, used to purchase additional holiday days, or saved.
• Personal and professional development opportunities.
• Hybrid working arrangement: 40% at the office, 40% from home, and 20% flexibly.
• With manager approval, work abroad in approved countries for up to 3 weeks per year, with a maximum of 2 consecutive weeks.
• The role is based at Eneco's Rotterdam headquarters and combines home and office working.