Third-Party Cyber Risk Manager

Eneco is one of Europe's leading sustainable energy companies, working toward climate neutrality by 2035 through our One Planet strategy. Our Digital & Tech and Security organisation is a critical enabler of that mission - and the TPRM programme you lead sits at the heart of how we manage risk across our supplier ecosystem.Programme Ownership and GovernanceOwn the TPRM framework end-to-end - policies, standards, procedures, risk registers, and playbooksLead governance forums and steer risk-based decision-making and risk acceptance processesDefine and track KPIs, KRIs, and executive dashboards that give management real visibility of supplier riskDrive continuous improvement across the full third-party lifecycle - from onboarding through to offboardingSupplier Assessments and Risk ManagementPerform and oversee security assessments of new and existing suppliers - reviewing ISO 27001, SOC reports, pen test results, BCDR plans, and security controlsEvaluate supplier cyber maturity, provide risk ratings, and define remediation requirementsMaintain risk registers, manage exceptions, and oversee remediation trackingImplement continuous monitoring for critical suppliers and manage periodic reassessmentsSupport supplier breach response activities alongside the incident management teamProcurement and Regulatory IntegrationEmbed mandatory security review gates into procurement - high-risk vendors do not get onboarded without assessment and approvalSupport contract reviews and security clause integration alongside Legal and ProcurementAlign TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR requirementsPrepare evidence and reporting for internal and external audits and regulatory examinationsPlatform and AutomationOwn and optimise the TPRM/GRC platform - driving automation of vendor onboarding, risk tiering, workflows, and reportingIdentify opportunities to reduce manual effort and increase assessment coverage through toolingDefine reporting capabilities that translate supplier risk data into actionable management insightEneco operates critical energy infrastructure and depends on a broad ecosystem of technology suppliers and service partners. As that ecosystem grows in complexity, so does the risk it carries - and regulators are paying close attention. NIS2 and DORA are not future considerations here. They are operational realities.As TPRM Lead you own the end-to-end Third Party Risk Management programme - from framework and governance through to supplier assessments, continuous monitoring, and procurement integration.

This is not an assessment execution role. You are here to mature the programme, increase its organisational reach, and make third-party cyber risk visible and manageable at every level of the business.You will work from within the CISO Office, partnering with Procurement, Legal, Compliance, Risk, Data Privacy, and IT. You will need to influence without formal authority - and you will have the mandate to do it.You are a senior TPRM professional who has built or significantly matured a third-party risk programme in a complex enterprise environment. You know how to assess a supplier, but more importantly you know how to design a programme that scales, earns organisational trust, and keeps pace with a shifting regulatory landscape. You are comfortable in a room with senior stakeholders, confident presenting risk data to the board, and able to push back constructively when a high-risk vendor is being fast-tracked without proper scrutiny.Experience5+ years hands-on experience in Third Party Risk Management7+ years in Cyber Security, IT Risk, Information Security, or GRCProven track record leading or maturing a TPRM programme in a large enterpriseExperience influencing senior stakeholders and embedding security controls into procurement and supplier governance processesFamiliarity with critical infrastructure or regulated sector environments is a strong plusKnowledge and ExpertiseDeep understanding of TPRM frameworks - vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception managementStrong knowledge of relevant regulations and standards - NIS2, DORA, ISO 27001, NIST CSF, GDPRHands-on experience with at least one GRC/TPRM platform - ServiceNow GRC, OneTrust, Archer, ProcessUnity or similarSolid grounding in information security domains - cloud security, identity and access management, incident management, and BCDRSkills and CompetenciesOwnership mindset - you take accountability for the programme, not just the tasksExecutive presence - you communicate risk clearly to senior stakeholders and translate complexity into decisionsAnalytical and data-driven - you use risk data to drive prioritisation, not just report statusAutomation mindset - you look for ways to increase coverage and reduce manual effort through tooling and process designCollaborative - you influence across Legal, Procurement, Risk, IT, and Business without formal authorityCertifications (preferred)CISSP, CISM, or CRISCISO 27001 Lead Implementer or Lead AuditorCertified Third Party Risk Professional (CTPRP) is a strong plusYou will be part of the CISO Office at Eneco, working within a security organisation that sits at the intersection of a major energy transition and a rapidly evolving regulatory environment.

Your stakeholders span Procurement, Legal, Compliance, Enterprise Risk, Data Privacy, IT, and the wider business - giving you broad organisational reach from day one.Eneco operates critical infrastructure and is directly in scope for NIS2 and DORA. That gives the TPRM programme real weight - and gives you a genuine mandate to drive change. We work hybrid, combining focused days from home with collaboration at Eneco's Rotterdam HQ.Please apply directly via the Eneco Careers Portal. Applications submitted by email will not be processed.Third Party DisclaimerEneco manages recruitment through selected channels and preferred partners. Unsolicited acquisition, candidate submissions, or commercial outreach in relation to this vacancy are not appreciated.Real programme ownership at a critical momentNIS2 and DORA are live.

Eneco operates critical energy infrastructure with a broad supplier ecosystem. You are not maintaining a mature programme - you are shaping what it becomes at exactly the moment it matters most.Influence that goes beyond securityThis role puts you at the table with Procurement, Legal, Compliance, and the business. TPRM at Eneco is not a back-office function - it is a business-critical capability with executive visibility.A mission that means somethingEneco's goal is climate neutrality by 2035. The infrastructure and supplier ecosystem you protect underpins that ambition. The work is serious, the stakes are real, and the organisation is committed.