Third Party Cyber Risk Manager (TPRM Lead)

Location: Rotterdam, Netherlands. Hybrid work: 40% at the office, 40% from home, and 20% flexibly; with manager approval, work abroad in approved countries for up to 3 weeks per year, with a maximum of 2 consecutive weeks.

Gross annual salary: €72,000–€90,100, including FlexBudget and an 8% holiday allowance; a bonus or collective profit sharing may apply depending on the role.

Company

hirify.global is a sustainable energy company working toward climate neutrality by 2035 and operating critical energy infrastructure with a broad technology supplier and service-partner ecosystem.

What you will do

• Own the end-to-end TPRM framework, including policies, standards, procedures, risk registers, playbooks, governance forums, risk acceptance, KPIs, KRIs, and executive dashboards.
• Perform and oversee supplier security assessments, evaluate cyber maturity, assign risk ratings, define remediation requirements, manage exceptions, and track remediation.
• Implement continuous monitoring and periodic reassessments for critical suppliers, and support supplier breach response with the incident management team.
• Embed mandatory security review gates into procurement and support contract reviews and security clause integration with Legal and Procurement.
• Align TPRM practices with NIS2, DORA, ISO 27001, NIST, and GDPR, and prepare evidence for audits and regulatory examinations.
• Own and optimise the TPRM/GRC platform, automating vendor onboarding, risk tiering, workflows, reporting, and assessment coverage.

Requirements

• 5+ years of hands-on Third Party Risk Management experience and 7+ years in Cyber Security, IT Risk, Information Security, or GRC.
• Proven experience leading or maturing a TPRM programme in a large enterprise.
• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes.
• Deep understanding of vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management.
• Strong knowledge of NIS2, DORA, ISO 27001, NIST CSF, and GDPR.
• Hands-on experience with at least one GRC/TPRM platform, such as ServiceNow GRC, OneTrust, Archer, ProcessUnity, or a similar platform.
• Solid grounding in cloud security, identity and access management, incident management, and BCDR.
• Ability to communicate risk clearly to senior stakeholders, translate complexity into decisions, use risk data for prioritisation, improve automation and coverage, and influence Legal, Procurement, Risk, IT, and Business without formal authority.

Nice to have

• Experience with critical infrastructure or regulated-sector environments.
• CISSP, CISM, CRISC, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor certification.
• Certified Third Party Risk Professional (CTPRP) certification.

Culture & Benefits

• Work within the CISO Office alongside Procurement, Legal, Compliance, Enterprise Risk, Data Privacy, IT, and the wider business.
• Hybrid working combining home, office, and flexible work, with limited approved work abroad.
• FlexBudget that can be paid out, used for additional holiday days, or saved.
• Personal and professional development support.
• 8% holiday allowance and a potential bonus or collective profit sharing depending on the role.

Hiring process

• Apply directly through the hirify.global Careers Portal; applications by email are not processed.