Third Party Risk Manager (Cybersecurity)

Location: Hybrid work in Rotterdam, Netherlands, with 40% at the office, 40% from home, and 20% flexible; approved work abroad is allowed for up to 3 weeks per year, with no more than 2 consecutive weeks.

Gross annual salary: €72,000–€90,100, including FlexBudget and 8% holiday allowance; a bonus or collective profit sharing may apply depending on the role.

Company

hirify.global is a sustainable energy company working toward climate neutrality by 2035 and operating critical energy infrastructure with a broad technology supplier ecosystem.

What you will do

• Own the end-to-end Third Party Risk Management framework, including policies, standards, procedures, risk registers, playbooks, governance forums, and risk acceptance.
• Lead supplier security assessments, evaluate cyber maturity, assign risk ratings, define remediation requirements, and manage exceptions and remediation tracking.
• Drive continuous monitoring and periodic reassessments of critical suppliers, including support for supplier breach response.
• Embed security review gates into procurement, support contract reviews and security clauses, and align practices with NIS2, DORA, ISO 27001, NIST, and GDPR.
• Own and optimise the TPRM/GRC platform, automating onboarding, risk tiering, workflows, monitoring, and reporting.
• Define KPIs, KRIs, executive dashboards, audit evidence, and management reporting that make supplier risk visible and actionable.

Requirements

• 5+ years of hands-on experience in Third Party Risk Management and 7+ years in Cyber Security, IT Risk, Information Security, or GRC.
• Proven experience leading or maturing a TPRM programme in a large enterprise.
• Experience influencing senior stakeholders and embedding security controls into procurement and supplier governance processes.
• Deep knowledge of vendor risk assessments, risk tiering, continuous monitoring, fourth-party risk, supply chain security, and exception management.
• Strong knowledge of NIS2, DORA, ISO 27001, NIST CSF, and GDPR.
• Hands-on experience with at least one GRC/TPRM platform, such as ServiceNow GRC, OneTrust, Archer, ProcessUnity, or a similar platform.
• Solid grounding in cloud security, identity and access management, incident management, and BCDR.
• Ability to communicate risk clearly to senior stakeholders, use risk data for prioritisation, influence without formal authority, and collaborate across Legal, Procurement, Risk, IT, and the business.

Nice to have

• Experience in critical infrastructure or regulated-sector environments.
• CISSP, CISM, CRISC, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor certification.
• Certified Third Party Risk Professional (CTPRP) certification.

Culture & Benefits

• Work within the CISO Office with stakeholders across Procurement, Legal, Compliance, Enterprise Risk, Data Privacy, IT, and the wider business.
• Hybrid working with focused home-working days and collaboration at the Rotterdam HQ.
• FlexBudget can be paid out, used to purchase additional holiday days, or saved.
• Personal and professional development support.
• Salary package includes 8% holiday allowance and may include a bonus or collective profit sharing.

Hiring process

• Apply directly through the hirify.global Careers Portal; applications submitted by email will not be processed.