Cybersecurity TPRM Strategy and Governance SME (Cybersecurity)

Location: Hybrid in San Juan or Aguadilla, Puerto Rico; work from an HPE office an average of 2 days per week.

Company

hirify.global is a global edge-to-cloud technology company helping organizations connect, protect, analyze, and act on data and applications.

What you will do

• Develop and maintain the enterprise cybersecurity third-party risk management strategy and operating model.
• Define and improve risk-based frameworks, methodologies, standards, and procedures across the third-party lifecycle.
• Lead the evolution of vendor criticality, inherent risk, residual risk, and due diligence frameworks.
• Streamline, automate, and optimize TPRM processes, tools, workflows, and user experience.
• Partner with Procurement, Legal, Compliance, Privacy, Supply Chain, IT, and business stakeholders to align processes with business and regulatory requirements.
• Establish KPIs, metrics, reporting, executive presentations, and strategic initiatives covering program maturity, risk exposure, compliance, and operational resilience.

Requirements

• Bachelor’s or Master’s degree in Engineering, Computer Science, Information Security, or an equivalent field.
• Typically 6–10 years of experience.
• Demonstrated experience designing or managing TPRM programs, frameworks, and governance models.
• Strong knowledge and experience in cybersecurity and IT security risks, threats, prevention measures, security fundamentals, and technologies.
• Strong knowledge of NIST CSF, NIST 800-53, ISO 27001, and industry best practices.
• Experience translating regulatory and security requirements into scalable policies, standards, and operational processes.
• Experience leading strategic initiatives, process transformation, and organizational change.
• Experience implementing or optimizing TPRM or GRC platforms such as OneTrust, Archer, or ServiceNow.
• Strong analytical, communication, stakeholder management, executive presentation, written, and verbal communication skills; mastery in English.

Nice to have

• CISSP certification preferred; CRISC, CISM, CISA, or equivalent certifications are also relevant.
• Knowledge of global regulatory requirements including DORA, NIS2, GDPR, SEC Cybersecurity Rules, and supply chain cybersecurity regulations.

Culture & Benefits

• Health and wellbeing benefits supporting physical, financial, and emotional wellbeing.
• Personal and professional development programs supporting career growth and knowledge specialization.
• Inclusive workplace committed to accessibility and valuing varied backgrounds.
• Flexible approach to managing work and personal needs.