CISO Officer (TPRM)

act digital; Brussel; Hybride; EUR 65 000 - 85 000; Plein temps

Résumé du poste

act digital seeks a Senior Third-Party Risk Manager to oversee cybersecurity risk across suppliers, partners, and service providers, ensuring security commitments align with the CISO strategy and regulatory standards throughout vendor relationships.

The role includes governing the TPRM framework, conducting security assessments, supporting procurement security, and reporting to the CISO and management, with Brussels on-site presence required two days per week.

Qualifications

• Fluency in Dutch, French and English (written and spoken).
• Master’s degree in IT, Law, Risk Management or Information Security.
• Active certification such as CISSP, CISM, CRISC, or CGEIT is required.
• Minimum 5 years in Third Party Risk Management, Security Assurance or related fields.
• Willing to work on-site at least 2 days/week in Brussels.

Responsabilités

• Establish and maintain the cybersecurity third party risk management framework.
• Assess security requirements in procurement and tender documentation.
• Review vendor security controls and contract commitments.
• Provide reporting and recommendations to CISO and management.

Connaissances

Dutch (C1)

French (C1)

English (C1)

Cybersecurity risk management

Regulatory awareness

Formation

Master's degree in IT/Law/Risk management/Info security

Description du poste

Ensure effective management of cybersecurity risks related to third parties (suppliers, partners, service providers, integrators, vendors) as well as the integration and enforcement of cybersecurity requirements within procurement and tendering processes (RFI, RFC, RFQ, RFP, tenders, etc.), in alignment with the CISO strategy, regulatory frameworks, and the organization’s standards.

The role aims to ensure that security commitments made with third parties are consistent, compliant, controlled, and traceable from a technical, regulatory, and contractual perspective throughout the entire lifecycle of the third-party relationship.

MAIN ACTIVITIES

Third Party Risk Management (TPRM)

• Establish, maintain, and continuously improve the cybersecurity third party risk management framework, in alignment with applicable regulatory and industry standards.
• Identify, analyse, and assess cybersecurity risks associated with third parties based on security questionnaires, supporting documentation (certifications, policies, audit reports), and reviews of proposed architectures or solutions.
• Define, monitor, and document risk mitigation measures, acceptance conditions, and related action plans.

Procurement Processes and Tender Documentation

• Review and secure cybersecurity requirements within procurement processes (RFI, RFC, RFQ, RFP, etc.) and tender documentation, ensuring compliance with applicable reference frameworks.
• Assess suppliers’ responses and proposals from a security, compliance, and risk management perspective.
• Contribute to drafting security-related responses and identify associated risks, conditions, and commitments, in collaboration with relevant stakeholders.

Reporting and Continuous Improvement

• Ensure reporting and monitoring of third-party risks and reviewed RFPs.
• Provide consolidated visibility to the CISO and management, and propose continuous improvement actions.

CONFORMITY CRITERIA

Evidence of compliance with the requested skills (criteria) needs to be provided in the CV:

• You communicate fluently in Dutch, French and English (spoken and written): Dutch or French at C1 level, the other language at least B2, English at least C1.
• Master’s degree in a relevant field from the following list: IT, law, risk management, information security.
• At least one active certification valid at submission date from the following list: ISC2 CISSP, CCSP, ISACA CISA, CRISC, CISM, CDPSE, or CGEIT.
• Minimum 5 years of experience in at least one of the following domains: such as Third Party Risk Management, Security Assurance, GRC / compliance, Audit or security assessment.
• Willing to work on-site at least 2 days per week in Brussels

EVALUATION CRITERIA

The more experience the better your proposal will be evaluated for this criterion.

• Level of experience with cybersecurity frameworks (number of projects, role, responsibilities)
• Experience in assessing IT/security architectures (scope, number of assessments, role)
• Experience in analyzing cybersecurity requirements and procurement documentation (scope and tasks)
• Experience in producing deliverables (type: reports, policies, assessments)
• Experience in analytical tasks (risk analysis, compliance, audits)
• Experience in drafting structured reports (type, audience, context)
• Level and complexity of stakeholder management (IT, Legal, CISO, etc.)
• Experience in risk-based decision making (examples in CV)