Third-Party Cyber Risk Manager

Location: Rotterdam, Netherlands. Hybrid work with 40% in the office, 40% from home, and 20% flexible; approved work abroad is allowed for up to 3 weeks per year, with a maximum of 2 consecutive weeks.

Gross annual salary: €72,000–€90,100, including FlexBudget and 8% holiday allowance.

Company

Sustainable energy company operating critical energy infrastructure and working toward climate neutrality by 2035.

What you will do

• Own the end-to-end third-party risk management framework, including policies, standards, procedures, registers, and playbooks.
• Lead governance forums, risk acceptance processes, executive reporting, and supplier risk decision-making.
• Perform and oversee supplier security assessments, risk ratings, remediation tracking, and continuous monitoring.
• Embed security review gates and contractual security requirements into procurement processes.
• Align the programme with NIS2, DORA, ISO 27001, NIST, and GDPR, preparing evidence for audits and regulatory examinations.
• Optimise the GRC/TPRM platform and automate onboarding, risk tiering, workflows, monitoring, and reporting.

Requirements

• 5+ years of hands-on experience in Third Party Risk Management and 7+ years in cybersecurity, IT risk, information security, or GRC.
• Experience leading or significantly maturing a TPRM programme in a large enterprise.
• Strong knowledge of supplier risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management.
• Experience influencing senior stakeholders and integrating security controls into procurement and supplier governance.
• Hands-on experience with a GRC/TPRM platform such as ServiceNow GRC, OneTrust, Archer, ProcessUnity, or similar.
• Knowledge of cloud security, identity and access management, incident management, and BCDR.

Nice to have

• Experience in critical infrastructure or regulated-sector environments.
• CISSP, CISM, CRISC, ISO 27001 Lead Implementer or Lead Auditor certification.
• Certified Third Party Risk Professional certification.

Culture & Benefits

• Work within the CISO Office with stakeholders across Procurement, Legal, Compliance, Enterprise Risk, Data Privacy, IT, and the wider business.
• Hybrid work combining home, office, and flexible working arrangements.
• FlexBudget can be paid out, used for additional holidays, or saved.
• Personal and professional development support.
• Bonus or collective profit sharing may apply depending on the role.

Hiring process

• Applications must be submitted directly through the careers portal; applications by email are not processed.