Third Party Risk Manager

Werken bij Eneco als Third Party Risk Manager

Eneco opereert kritieke energie-infrastructuur en is direct afhankelijk van een breed ecosysteem aan technologieleveranciers en servicepartners. Naarmate dit ecosysteem complexer wordt, groeit ook het risico en stelt de wetgeving strengere eisen, zoals NIS2 en DORA. In deze rol als TPRM Lead ben jij de eigenaar van het end-to-end Third Party Risk Management-programma. Je werkt vanuit de CISO Office en slaat een brug tussen Procurement, Legal, Compliance, Risk, Data Privacy en IT.

Wat wij bieden

Bij Eneco krijg je de ruimte om impact te maken binnen een dynamische organisatie die midden in de energietransitie staat. Je krijgt een cruciale rol waarin je het risicobeleid naar een hoger niveau tilt. Daarnaast profiteer je van uitstekende arbeidsvoorwaarden, waaronder een scherpe beloning, een vaste eindejaarsuitkering en variabele beloningscomponenten. Je werkt in een hybride werkomgeving vanuit ons moderne hoofdkantoor in Rotterdam in combinatie met de flexibiliteit van thuiswerken.

Wil jij bijdragen aan de veiligheid van onze kritieke infrastructuur en het verschil maken? Solliciteer direct via de knop!

Belangrijkste verantwoordelijkheden

• Own the TPRM framework end-to-end - policies, standards, procedures, risk registers, and playbooks

• Lead governance forums and steer risk-based decision-making and risk acceptance processes

• Define and track KPIs, KRIs, and executive dashboards that give management real visibility of supplier risk

• Drive continuous improvement across the full third-party lifecycle - from onboarding through to offboarding

• Perform and oversee security assessments of new and existing suppliers - reviewing ISO 27001, SOC reports, pen test results, BCDR plans, and security controls

• Evaluate supplier cyber maturity, provide risk ratings, and define remediation requirements

• Maintain risk registers, manage exceptions, and oversee remediation tracking

• Implement continuous monitoring for critical suppliers and manage periodic reassessments

• Support supplier breach response activities alongside the incident management team

• Embed mandatory security review gates into procurement - high-risk vendors do not get onboarded without assessment and approval

• Support contract reviews and security clause integration alongside Legal and Procurement

• Align TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR requirements

• Prepare evidence and reporting for internal and external audits and regulatory examinations

• Own and optimise the TPRM/GRC platform - driving automation of vendor onboarding, risk tiering, workflows, and reporting

• Identify opportunities to reduce manual effort and increase assessment coverage through tooling

• Define reporting capabilities that translate supplier risk data into actionable management insight

Vereisten

• 5+ years hands-on experience in Third Party Risk Management

• 7+ years in Cyber Security, IT Risk, Information Security, or GRC

• Proven track record leading or maturing a TPRM programme in a large enterprise

• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes

• Familiarity with critical infrastructure or regulated sector environments is a strong plus

• Deep understanding of TPRM frameworks - vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management

• Strong knowledge of relevant regulations and standards - NIS2, DORA, ISO 27001, NIST CSF, GDPR

• Hands-on experience with at least one GRC/TPRM platform - ServiceNow GRC, OneTrust, Archer, ProcessUnity or similar

• Solid grounding in information security domains - cloud security, identity and access management, incident management, and BCDR

• Ownership mindset - you take accountability for the programme, not just the tasks

• Executive presence - you communicate risk clearly to senior stakeholders and translate complexity into decisions

• Analytical and data-driven - you use risk data to drive prioritisation, not just report status

• Automation mindset - you look for ways to increase coverage and reduce manual effort through tooling and process design

• Collaborative - you influence across Legal, Procurement, Risk, IT, and Business without formal authority

• CISSP, CISM, or CRISC (preferred)

• ISO 27001 Lead Implementer or Lead Auditor (preferred)

• Certified Third Party Risk Professional (CTPRP) is a strong plus

Secundaire arbeidsvoorwaarden

• Extra beloning (bijv. 13e maand, vaste eindejaarsuitkering)
• Prestatiegebonden beloning