Security Consultant TPRM - Energy

Project overview

Context

As part of its NIS2 compliance and the CCB's CyberFundamentals (CyFun®) framework, a company in Belgium is structuring a security risk management program for its suppliers and subcontractors (TPRM), covering the entire third-party lifecycle. This initiative involves the Purchasing, Legal, Data Protection, Projects, Processes, IT, and CISO teams.

A first scoping phase is underway: mapping existing processes, target governance model, roles, and responsibilities. The mission consists of continuing this work, formalizing the system and its tools, and then supporting its progressive implementation on critical suppliers before scaling up.

Missions

Working Conditions

• Finalization of scoping and governance
• Continue defining the TPRM governance model and associated roles, and support its adoption
• Contribute to formalizing the third-party risk management policy, procedure, and framework
• Assess the level of compliance with NIS2 / CyFun® requirements and contribute to prioritizing actions
• Structure the system's tools: inventory, criticality criteria, impact and maturity questionnaires, risk register, action plans, reporting materials
• Monitor progress and ensure reporting to the CISO and governance bodies
• Preparation and implementation of the system
• Contribute to the inventory of critical suppliers, assessment of their criticality and their business and IT dependencies
• Conduct or support supplier risk analyses, formalize risks, and monitor treatment and remediation plans
• Define a proportionate approach to assessing and monitoring third parties, according to their criticality level
• Integrate security requirements into purchasing, project, and contracting processes
• Support deployment on pilot scopes: risk analyses, supplier committees, evidence collection, targeted audits if necessary
• Capitalize on pilots to improve the model, methods, and tools
• Scaling and transverse coordination
• Prepare the extension of the system to other critical suppliers, then to sensitive suppliers and new markets, according to the scope defined by the client
• Anchor TPRM in existing processes with the Purchasing, Legal, Data Protection, Projects, Processes, and CISO teams
• Lead workshops, interviews, and committees with internal stakeholders and suppliers
• Prepare clear summaries: progress, decisions needed, risks, action plans, open points
• Contribute to training and awareness of stakeholders to ensure the system's sustainability
• Type of mission: Time & Material (contracting)
• Department: Security (SECU)
• Volume: 120 days
• Languages: French C2 (required), English B2
• Remote work: 3-4 days/week
• Location: Liège

Project details

• Start: flexible
• Remote: hybrid
• Location: Liège, Belgium, BE
• Languages: French