Third-Party Risk Manager

Details

Eneco is seeking a senior Third-Party Risk Management professional to own and mature the end-to-end TPRM programme within the CISO Office. The role operates in a critical infrastructure environment and works closely with Procurement, Legal, Compliance, Enterprise Risk, Data Privacy, IT, and the wider business. NIS2 and DORA are operational realities for the organisation, giving the role broad organisational reach and a mandate to drive change.

Responsibilities

• Own the TPRM framework end-to-end, including policies, standards, procedures, risk registers, and playbooks.
• Lead governance forums and risk-based decision-making and risk acceptance processes.
• Define and track KPIs, KRIs, and executive dashboards for supplier risk.
• Drive continuous improvement across the third-party lifecycle, from onboarding through offboarding.
• Perform and oversee supplier security assessments, including reviews of ISO 27001 certifications, SOC reports, penetration test results, BCDR plans, and security controls.
• Evaluate supplier cyber maturity, assign risk ratings, define remediation requirements, manage exceptions, and oversee remediation tracking.
• Implement continuous monitoring for critical suppliers and manage periodic reassessments.
• Support supplier breach response activities alongside the incident management team.
• Embed mandatory security review gates into procurement and prevent high-risk vendors from being onboarded without assessment and approval.
• Support contract reviews and security clause integration with Legal and Procurement.
• Align TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR.
• Prepare evidence and reporting for internal and external audits and regulatory examinations.
• Own and optimise the TPRM/GRC platform, including automation of vendor onboarding, risk tiering, workflows, and reporting.
• Identify opportunities to increase assessment coverage and reduce manual effort through tooling and process design.
• Translate supplier risk data into actionable management insight and present risk clearly to senior stakeholders and the board.

Requirements

• At least 5 years of hands-on experience in Third-Party Risk Management.
• At least 7 years of experience in Cyber Security, IT Risk, Information Security, or GRC.
• Proven experience leading or maturing a TPRM programme in a large enterprise.
• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes.
• Familiarity with critical infrastructure or regulated-sector environments is advantageous.
• Deep understanding of vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management.
• Strong knowledge of NIS2, DORA, ISO 27001, NIST CSF, and GDPR.
• Hands-on experience with at least one GRC/TPRM platform, such as ServiceNow GRC, OneTrust, Archer, ProcessUnity, or a similar platform.
• Solid understanding of cloud security, identity and access management, incident management, and BCDR.
• Strong ownership, executive communication, analytical, data-driven, automation, collaboration, and influencing skills.
• Preferred certifications include CISSP, CISM, CRISC, ISO 27001 Lead Implementer or Lead Auditor, and Certified Third Party Risk Professional (CTPRP).

Benefits

• Gross annual salary of €72,000–€90,100, including FlexBudget and 8% holiday allowance; a bonus or collective profit sharing may apply depending on the role.
• FlexBudget that can be paid out, exchanged for additional holiday days, or saved.
• Personal and professional development opportunities.
• Hybrid working arrangement: 40% in the office, 40% from home, and 20% flexibly.
• With manager approval, working abroad within approved countries is possible for up to 3 weeks per year, with a maximum of 2 consecutive weeks.
• Flexible working hours and the option to work from home where the role allows it.

The role is based in Eneco's Rotterdam headquarters and is part of the CISO Office.