Cybersecurity TPRM Strategy and Governance SME

Description

This is a hybrid role: you will spend on average 2 days per week in an HPE office.

The company is a global edge-to-cloud business that helps other companies connect, protect, analyze and act on their data and applications, from the edge to the cloud.

The role owns the organization's third-party cybersecurity risk management strategy, operating model and governance framework, and aims to make the program more mature, efficient and scalable through risk-based processes, standards, methods and technology.

Responsibilities

• Build and keep up the enterprise third-party risk management (TPRM) strategy and operating model for cybersecurity.
• Set and keep improving risk-based frameworks, methods, standards and procedures for handling third-party cybersecurity risk.
• Drive changes to how vendor criticality, inherent risk, residual risk and due diligence are assessed.
• Find ways to streamline, automate and optimize TPRM processes so they scale better, run more efficiently and are easier to use.
• Work with Procurement, Legal, Compliance, Privacy, Supply Chain, IT and business stakeholders so TPRM fits business goals and regulatory demands.
• Define metrics, KPIs and reporting to track program effectiveness, risk exposure and operational performance.
• Advise on emerging risks such as supply chain security, software supply chain risk, cloud providers, AI-related risk and operational resilience.
• Evaluate TPRM tools and technology and lead the automation and workflow changes that follow.
• Prepare executive reports and presentations on program maturity, risks and strategic initiatives.
• Support company-wide work on regulatory compliance, cybersecurity governance and operational resilience.
• Guide and mentor less experienced staff.

Requirements

• A bachelor's or master's degree in engineering, computer science, information security or an equivalent field.
• Typically 6 to 10 years of experience.
• Demonstrated experience designing or running TPRM programs, frameworks and governance models.
• Solid knowledge of cyber and IT security risks, threats and preventive controls.
• Strong knowledge of frameworks such as NIST CSF, NIST 800-53 and ISO 27001, and of industry good practice.
• Knowledge of security fundamentals and technologies.
• Experience turning regulatory and security requirements into scalable policies, standards and operational processes.
• Experience leading strategic initiatives, process change and organizational transformation.
• Experience implementing or improving TPRM or GRC platforms such as OneTrust, Archer or ServiceNow.
• Knowledge of global regulations including DORA, NIS2, GDPR, SEC cybersecurity rules and supply chain cybersecurity regulations.
• Strong analytical, communication, stakeholder management and executive presentation skills.
• Excellent written and spoken English.
• Preferred: CISSP, with CRISC, CISM, CISA or equivalent certifications also valued.

Conditions

Hybrid setup: on average 2 days per week in an HPE office.

Equal-opportunity employer: decisions are based on qualifications, merit and business need.

Accommodation requests for the application or interview process can be made through the company's secure form.

Benefits

• Health and wellbeing support covering physical, financial and emotional needs.
• Career development programs, including paths to become a subject expert or move into another division.
• A culture that values varied backgrounds and offers flexibility to manage work and personal needs.