Third-Party Cyber Risk Manager (TPRM Lead)

Details

Eneco is seeking a Third-Party Cyber Risk Manager to own and mature its end-to-end Third-Party Risk Management programme. The role sits within the CISO Office and works across Procurement, Legal, Compliance, Enterprise Risk, Data Privacy, IT, and the wider business. Eneco operates critical energy infrastructure and is directly in scope for NIS2 and DORA.

The role involves shaping the TPRM programme, increasing its organisational reach, integrating security into procurement and supplier governance, and making third-party cyber risk visible and manageable across the business.

Responsibilities

• Own the TPRM framework end-to-end, including policies, standards, procedures, risk registers, and playbooks.
• Lead governance forums and steer risk-based decision-making and risk acceptance processes.
• Define and track KPIs, KRIs, and executive dashboards for supplier risk visibility.
• Drive continuous improvement across the third-party lifecycle, from onboarding through offboarding.
• Perform and oversee security assessments of new and existing suppliers, reviewing ISO 27001 certifications, SOC reports, penetration test results, BCDR plans, and security controls.
• Evaluate supplier cyber maturity, provide risk ratings, and define remediation requirements.
• Maintain risk registers, manage exceptions, and oversee remediation tracking.
• Implement continuous monitoring for critical suppliers and manage periodic reassessments.
• Support supplier breach response activities alongside the incident management team.
• Embed mandatory security review gates into procurement.
• Support contract reviews and security clause integration with Legal and Procurement.
• Align TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR requirements.
• Prepare evidence and reporting for internal and external audits and regulatory examinations.
• Own and optimise the TPRM/GRC platform, including automation of vendor onboarding, risk tiering, workflows, and reporting.
• Identify opportunities to reduce manual effort and increase assessment coverage through tooling.
• Define reporting capabilities that translate supplier risk data into actionable management insight.

Requirements

• At least 5 years of hands-on experience in Third-Party Risk Management.
• At least 7 years of experience in Cyber Security, IT Risk, Information Security, or GRC.
• Proven experience leading or maturing a TPRM programme in a large enterprise.
• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes.
• Familiarity with critical infrastructure or regulated-sector environments is preferred.
• Deep understanding of vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management.
• Strong knowledge of NIS2, DORA, ISO 27001, NIST CSF, and GDPR.
• Hands-on experience with at least one GRC or TPRM platform, such as ServiceNow GRC, OneTrust, Archer, ProcessUnity, or a similar platform.
• Solid grounding in cloud security, identity and access management, incident management, and BCDR.
• Strong ownership, executive communication, analytical, data-driven, automation, collaboration, and influencing skills.
• Preferred certifications include CISSP, CISM, CRISC, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, or Certified Third Party Risk Professional (CTPRP).

Working Arrangement

The role is based at Eneco's Rotterdam headquarters and follows a hybrid model: 40% at the office, 40% from home, and 20% flexible. With manager approval, employees may work abroad within approved countries for up to three weeks per year, with a maximum of two consecutive weeks.

Benefits

• Gross annual salary between €72,000 and €90,100, including FlexBudget and 8% holiday allowance.
• Depending on the role, a bonus or collective profit sharing.
• FlexBudget that can be paid out, used to buy additional holiday days, or saved.
• Personal and professional development opportunities.
• Flexible working hours and the option to work from home.