Description
The Cybersecurity TPRM Strategy & Governance SME is responsible for defining and advancing the organization's third-party cybersecurity risk management strategy, operating model, and governance framework.
Responsibilities:
- Develop and maintain the enterprise Cybersecurity Third-Party Risk Management (TPRM) strategy and operating model.
- Define and continuously improve third-party risk-based frameworks, methodologies, standards, and procedures for managing third-party cybersecurity risk.
- Lead the evolution of vendor criticality, inherent risk, residual risk, and due diligence frameworks.
- Identify opportunities to streamline, automate, and optimize TPRM processes to improve scalability, efficiency, and user experience.
- Partner with Procurement, Legal, Compliance, Privacy, Supply Chain, IT, and business stakeholders to align TPRM processes with business objectives and regulatory requirements.
- Establish metrics, KPIs, and reporting frameworks to measure program effectiveness, risk exposure, and operational performance.
- Provide thought leadership on emerging risks, including supply chain security, software supply chain risk, cloud providers, AI-related risks, and operational resilience.
- Lead assessments of TPRM tools and technology solutions and drive automation and workflow improvements.
- Develop executive-level reporting and presentations to communicate program maturity, risks, and strategic initiatives.
- Support enterprise-wide initiatives related to regulatory compliance, cybersecurity governance, and operational resilience.
- Provide guidance and mentoring to less-experienced staff members.
Education and Experience Required:
- Bachelor's or Master's degree in Engineering, Computer Science, Information Security or equivalent.
- Typically 6-10 years experience.
- Security Certifications: preferred - CISSP (other CRISC, CISM, etc.)
Knowledge and Skills:
- Demonstrated experience and in-depth knowledge in designing or managing TPRM programs, frameworks, and governance models.
- Solid knowledge and demonstrated experience of Cyber and IT security risks, threats, and prevention measures.
- Strong knowledge of cybersecurity and risk management frameworks such as NIST CSF, NIST 800-53, ISO 27001, and industry best practices.
- Knowledge and experience of security fundamentals and technologies.
- Experience translating regulatory and security requirements into scalable policies, standards, and operational processes.
- Experience leading strategic initiatives, process transformation, and organizational change.
- Industry certifications such as CISSP, CISM, CRISC, CISA, or equivalent.
- Experience implementing or optimizing TPRM or GRC platforms (OneTrust, Archer, ServiceNow, etc.).
- Strong analytical, communication, stakeholder management, and executive presentation skills.
- Excellent written and verbal communication skills; mastery in English.