Cybersecurity TPRM Strategy & Governance Principal SME

Description

You will set and lead the company's third-party cybersecurity risk strategy, governance model and operating framework across the whole enterprise.

The role covers cybersecurity due diligence, supply chain security and operational resilience, and keeps the company compliant as rules change, including DORA, NIS2, the EU Cyber Resilience Act, SEC cybersecurity rules and new global regulations.

The company builds technology that helps organizations connect, protect, analyze and act on their data and applications, from edge to cloud.

Function: Information Technology. Job level: Master.

Responsibilities

• Lead third-party cyber governance and due diligence, keeping them aligned with DORA, NIS2, the EU Cyber Resilience Act, GDPR, SEC cybersecurity rules and emerging cyber and resilience regulations.
• Make senior-level calls on complex third-party risk decisions.
• Design company-wide due diligence frameworks, assessment methods, standards and requirements that support compliance, resilience and effective third-party risk management.
• Evolve the frameworks for vendor criticality, inherent and residual risk, concentration risk, operational resilience and continuous monitoring.
• Work with Procurement, Legal, Compliance, Privacy, Internal Audit, Enterprise Risk Management, IT, Supply Chain and business teams to put regulatory requirements and cyber controls in place.
• Run executive governance forums, prepare for regulatory reviews, and guide strategic decisions on third-party cyber risk and resilience.
• Assess emerging third-party risks, including AI, cloud providers, software supply chains, critical infrastructure, geopolitical shifts and changing threats.
• Lead company-wide transformation to make the program more scalable, efficient and user friendly, and to strengthen how risk is managed.
• Offer thought leadership and mentor less experienced staff and cross-functional leads.
• Set the direction for risk-based due diligence, vendor oversight, operational resilience and supply chain cyber programs. Shape executive decisions, guide TPRM transformation, and drive adoption of scalable governance, automation and technology across the full third-party lifecycle.

Requirements

• Bachelor's or Master's degree in computer science, information security, cybersecurity, engineering or an equivalent field.
• Typically 10-15+ years in cybersecurity, risk management, governance, regulatory compliance or a closely related area.
• Significant experience designing, running or transforming enterprise TPRM, supply chain cybersecurity or GRC programs.
• A track record of driving enterprise cyber strategy, governance, compliance and transformation.
• Industry certification such as CISSP, CISM, CRISC or equivalent.
• Deep expertise in TPRM, supply chain cybersecurity, cyber supply chain risk management (C-SCRM) and cyber governance.
• Expertise in global cyber rules, including DORA, NIS2, the EU Cyber Resilience Act and emerging cyber and operational resilience requirements.
• Advanced command of NIST CSF, NIST 800-53, NIST SSDF, ISO 27001, ISO 22301 and leading practice.
• Experience turning complex regulatory and cyber requirements into policies, standards, governance structures, operating models and scalable risk processes.
• A proven record of setting and carrying out multi-year cyber strategy, and shaping direction through executive engagement and thought leadership.
• Strong skill at interpreting regulation and judging its effect on third parties.
• Strong executive presence, with excellent stakeholder management, communication, presentation and influencing skills.
• Experience influencing senior leaders and running complex cross-functional programs.
• A track record leading enterprise transformation that delivers measurable business results through governance, innovation and strategic leadership.
• Excellent written and spoken English.

Conditions

Onsite role, with the expectation that you will work mainly from a company office.

Base salary in the United States is USD 140,000 to 321,000 per year for roles in Texas. The actual offer may vary by location, experience, education, training or skill level.

Variable incentives may be offered in addition to base salary.

The company is an equal opportunity employer that does not discriminate on the basis of race, gender or any other protected category, and it welcomes applications from qualified individuals with disabilities, including those requiring accommodation.

Benefits

• Health and wellbeing coverage that supports physical, financial and emotional wellbeing for team members and their families.
• Development programs to help you reach career goals, from becoming a subject expert to moving into another division.
• Flexibility to manage work alongside personal needs.
• US benefit details are published on the company's benefits enrollment site.