TPRM Security Consultant, Supplier Risk Management

Project overview

The mission aims to manage and deploy a Third-Party Risk Management (TPRM) system in the context of NIS2 compliance.

Profile of the suited interim professional:

• Finalize the TPRM governance model and support the assignment of associated roles
• Participate in drafting the supplier risk management policy, procedures, and framework
• Assess compliance with NIS2 and CyFun® requirements and help prioritize corrective actions
• Structure the system's tools, including the supplier inventory, criticality criteria, and risk registers
• Ensure progress reporting to the CISO and governance bodies
• Contribute to the inventory and criticality assessment of suppliers
• Lead or support supplier-related risk analyses and ensure follow-up of remediation plans
• Define a proportionate method for assessing and monitoring third parties according to their risk level
• Integrate security requirements into purchasing, project, and contracting processes
• Support the pilot deployment through risk analyses, supplier committees, and targeted audits
• Prepare for the extension of the system to critical and sensitive suppliers as well as new markets
• Collaborate with Purchasing, Legal, Data Protection, Projects, and CISO teams to anchor TPRM
• Organize workshops and committees involving internal stakeholders and suppliers
• Prepare summaries on progress, decisions, risks, and actions
• Contribute to training and awareness actions for stakeholders
• Good knowledge of NIS2 and the CyFun® or NIST CSF framework
• Experience in third-party risk management across the entire supplier lifecycle
• Professional experience in the energy or critical infrastructure sector
• Experience collaborating with Purchasing, Legal, business, and IT/Security teams
• Proven experience in information security risk analysis
• Solid background in GRC consulting or management applied to cybersecurity
• Solid background in managing security-related programs or projects
• Proven experience as a security consultant
• Experience in monitoring risk treatment and remediation plans
• Experience in assessing maturity or compliance against a control framework
• French level C2
• Experience in facilitating workshops and committees, and in reporting to steering committees
• Mastery of the EBIOS methodology
• Knowledge of security frameworks such as ISO 27000, COBIT for Security, NIST, OWASP, or CIS Controls
• Experience in implementing or using GRC tools for supplier inventory and risk monitoring
• English level B2

Project details

• Start: flexible
• Location: Luik, Liège, Luxembourg, LU
• Languages: French