Third Party Cyber Risk Manager (TPRM Lead)

Werken bij Eneco als TPRM Lead

Eneco opereert in het hart van de energietransitie en beheert kritieke energie-infrastructuur. Dit brengt een complex ecosysteem van technologieleveranciers en servicepartners met zich mee, waarbij cybersecurity en regelgeving zoals NIS2 en DORA van cruciaal belang zijn. Als Third Party Cyber Risk Manager neem je de volledige ownership over het Third Party Risk Management-programma en zorg je ervoor dat leveranciersrisico's zichtbaar en beheersbaar blijven.

Je komt te werken vanuit het CISO Office en werkt nauw samen met disciplines zoals Inkoop, Legal, Compliance, Enterprise Risk en IT. Je krijgt de mandaat om het programma verder te volwassen te maken en impact te maken op het snijvlak van duurzame energie en digitale veiligheid.

Wat wij bieden

Bij Eneco investeren we in onze medewerkers met uitstekende arbeidsvoorwaarden, waaronder een marktconform salaris, vaste en variabele extra uitkeringen, en de flexibiliteit van hybride werken vanuit ons hoofdkantoor in Rotterdam.

Solliciteer vandaag nog en help Eneco veilig de energietransitie vorm te geven!

Belangrijkste verantwoordelijkheden

• Own the TPRM framework end-to-end - policies, standards, procedures, risk registers, and playbooks

• Lead governance forums and steer risk-based decision-making and risk acceptance processes

• Define and track KPIs, KRIs, and executive dashboards that give management real visibility of supplier risk

• Drive continuous improvement across the full third-party lifecycle - from onboarding through to offboarding

• Perform and oversee security assessments of new and existing suppliers - reviewing ISO 27001, SOC reports, pen test results, BCDR plans, and security controls

• Evaluate supplier cyber maturity, provide risk ratings, and define remediation requirements

• Maintain risk registers, manage exceptions, and oversee remediation tracking

• Implement continuous monitoring for critical suppliers and manage periodic reassessments

• Support supplier breach response activities alongside the incident management team

• Embed mandatory security review gates into procurement - high-risk vendors do not get onboarded without assessment and approval

• Support contract reviews and security clause integration alongside Legal and Procurement

• Align TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR requirements

• Prepare evidence and reporting for internal and external audits and regulatory examinations

• Own and optimise the TPRM/GRC platform - driving automation of vendor onboarding, risk tiering, workflows, and reporting

• Identify opportunities to reduce manual effort and increase assessment coverage through tooling

• Define reporting capabilities that translate supplier risk data into actionable management insight

Vereisten

• 5+ years hands-on experience in Third Party Risk Management

• 7+ years in Cyber Security, IT Risk, Information Security, or GRC

• Proven track record leading or maturing a TPRM programme in a large enterprise

• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes

• Deep understanding of TPRM frameworks - vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management

• Strong knowledge of relevant regulations and standards - NIS2, DORA, ISO 27001, NIST CSF, GDPR

• Hands-on experience with at least one GRC/TPRM platform - ServiceNow GRC, OneTrust, Archer, ProcessUnity or similar

• Solid grounding in information security domains - cloud security, identity and access management, incident management, and BCDR

• Ownership mindset - you take accountability for the programme, not just the tasks

• Executive presence - you communicate risk clearly to senior stakeholders and translate complexity into decisions

• Analytical and data-driven - you use risk data to drive prioritisation, not just report status

• Automation mindset - you look for ways to increase coverage and reduce manual effort through tooling and process design

• Collaborative - you influence across Legal, Procurement, Risk, IT, and Business without formal authority

• Certifications (preferred): CISSP, CISM, or CRISC, ISO 27001 Lead Implementer or Lead Auditor, Certified Third Party Risk Professional (CTPRP)

Secundaire arbeidsvoorwaarden

• Extra beloning (bijv. 13e maand, vaste eindejaarsuitkering)
• Prestatiegebonden beloning