Third-Party Cyber Risk Manager

Werken als Third-Party Cyber Risk Manager bij Eneco

Eneco opereert in het hart van de energietransitie en beheert kritieke energie-infrastructuur. Dit brengt een complex ecosysteem van technologieleveranciers en servicepartners met zich mee, waarbij regelgeving zoals NIS2 en DORA direct van toepassing zijn. Binnen het CISO Office speel je een cruciale rol in het volwassen maken en borgen van het Third-Party Risk Management (TPRM) programma.

In deze rol werk je nauw samen met disciplines zoals Inkoop, Legal, Compliance en IT. Je krijgt de ruimte en het mandaat om impact te maken, processen te automatiseren en leveranciersrisico's inzichtelijk te maken voor het senior management. Je krijgt energie van het bouwen van schaalbare structuren en het overtuigen van stakeholders.

Eneco biedt uitstekende arbeidsvoorwaarden, waaronder een hybride werkomgeving waarin je gefocust thuiswerkt en samenwerkt op het hoofdkantoor in Rotterdam. Solliciteer nu via de knop en draag bij aan een veilige energietransitie!

Belangrijkste verantwoordelijkheden

• Own the TPRM framework end-to-end - policies, standards, procedures, risk registers, and playbooks

• Lead governance forums and steer risk-based decision-making and risk acceptance processes

• Define and track KPIs, KRIs, and executive dashboards that give management real visibility of supplier risk

• Drive continuous improvement across the full third-party lifecycle - from onboarding through to offboarding

• Perform and oversee security assessments of new and existing suppliers - reviewing ISO 27001, SOC reports, pen test results, BCDR plans, and security controls

• Evaluate supplier cyber maturity, provide risk ratings, and define remediation requirements

• Maintain risk registers, manage exceptions, and oversee remediation tracking

• Implement continuous monitoring for critical suppliers and manage periodic reassessments

• Support supplier breach response activities alongside the incident management team

• Embed mandatory security review gates into procurement - high-risk vendors do not get onboarded without assessment and approval

• Support contract reviews and security clause integration alongside Legal and Procurement

• Align TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR requirements

• Prepare evidence and reporting for internal and external audits and regulatory examinations

• Own and optimise the TPRM/GRC platform - driving automation of vendor onboarding, risk tiering, workflows, and reporting

• Identify opportunities to reduce manual effort and increase assessment coverage through tooling

• Define reporting capabilities that translate supplier risk data into actionable management insight

Vereisten

• 5+ years hands-on experience in Third Party Risk Management

• 7+ years in Cyber Security, IT Risk, Information Security, or GRC

• Proven track record leading or maturing a TPRM programme in a large enterprise

• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes

• Deep understanding of TPRM frameworks - vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management

• Strong knowledge of relevant regulations and standards - NIS2, DORA, ISO 27001, NIST CSF, GDPR

• Hands-on experience with at least one GRC/TPRM platform - ServiceNow GRC, OneTrust, Archer, ProcessUnity or similar

• Solid grounding in information security domains - cloud security, identity and access management, incident management, and BCDR

• Ownership mindset - you take accountability for the programme, not just the tasks

• Executive presence - you communicate risk clearly to senior stakeholders and translate complexity into decisions

• Analytical and data-driven - you use risk data to drive prioritisation, not just report status

• Automation mindset - you look for ways to increase coverage and reduce manual effort through tooling and process design

• Collaborative - you influence across Legal, Procurement, Risk, IT, and Business without formal authority

Secundaire arbeidsvoorwaarden

• Extra beloning (bijv. 13e maand, vaste eindejaarsuitkering)
• Prestatiegebonden beloning