Description
Hewlett Packard Enterprise is seeking a Cybersecurity TPRM Strategy & Governance Principal SME to define and drive the company's enterprise third-party cybersecurity risk strategy, governance, and operating framework.
The successful candidate will provide thought leadership and strategic direction for the design, implementation, and continuous improvement of risk-based due diligence, vendor oversight, operational resilience, and supply chain cybersecurity programs.
Key responsibilities include:
- Serving as the lead for third-party cybersecurity governance, regulatory and cybersecurity due diligence
- Providing senior-level expertise and leadership for complex risk decisions related to third parties
- Designing and driving organization-wide cybersecurity due diligence frameworks, assessment methodologies, standards, and requirements
- Leading the evolution of vendor criticality, inherent risk, residual risk, concentration risk, operational resilience, and continuous monitoring frameworks
- Partnering with Procurement, Legal, Compliance, Privacy, Internal Audit, Enterprise Risk Management, IT, Supply Chain, and business stakeholders to drive regulatory requirements and cybersecurity controls
- Driving executive governance forums, regulatory readiness initiatives, and strategic decision-making related to third-party cybersecurity risk and resilience
- Evaluating third-party emerging risks related to artificial intelligence, cloud providers, software supply chains, critical infrastructure, geopolitical developments, and evolving threat landscapes
- Driving enterprise-wide transformation initiatives that improve scalability, operational efficiency, user experience, and risk management effectiveness
- Providing thought leadership and mentoring to less experienced staff members and other cross-functional leads
The ideal candidate will have:
- A Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, Engineering, or equivalent
- Typically, 10-15+ years of experience in cybersecurity, risk management, governance, regulatory compliance, or related disciplines
- Significant experience in designing, leading, and transforming enterprise Third-Party Risk Management (TPRM), Supply Chain Cybersecurity, or Governance, Risk, and Compliance (GRC) programs
- Demonstrated experience driving enterprise-wide cybersecurity strategy, governance, regulatory compliance, and transformation initiatives
- Industry certifications such as CISSP, CISM, CRISC, or equivalent
In terms of skills, the successful candidate will have:
- Expert knowledge of Third-Party Risk Management (TPRM), Supply Chain Cybersecurity, Cyber Supply Chain Risk Management (C-SCRM), and Cybersecurity Governance
- Expertise in global cybersecurity regulations and regulatory frameworks, including DORA, NIS2, EU Cyber Resilience Act (CRA), and emerging cyber and operational resilience requirements
- Advanced knowledge of cybersecurity and risk frameworks, including NIST CSF, NIST 800-53, NIST SSDF, ISO 27001, ISO 22301, and industry best practices
- Demonstrated experience translating complex regulatory and cybersecurity requirements into enterprise policies, standards, governance frameworks, operating models, and scalable risk management processes
- Proven ability to define and execute long-term cybersecurity strategy and influence organizational direction through executive engagement and thought leadership
- Strong expertise in regulatory interpretation and impact to third parties
- Strong executive presence with exceptional stakeholder management, communication, presentation, and influencing skills
- Proven experience influencing executive leadership and leading complex cross-functional programs
- Demonstrated success leading enterprise transformation programs and driving measurable business outcomes through governance, innovation, and strategic leadership
- Excellent written and verbal communication skills; mastery in English
The salary range for this position is $140,000 - $321,000 per year, depending on geographic location, work experience, education/training, and/or skill level.