Third-Party Risk Management (TPRM) Security Consultant – NIS2

Harvey Nash; Luik; On-site; EUR 70,000 - 100,000; Full time

Job summary

Harvey Nash Group is leading a steering and implementation mission for the TPRM program under NIS2. The role focuses on governance framing, policy formalization, and risk-based actions with cross-functional collaboration across Purchasing, Legal, Data Protection, Projects and IT/Security teams.

French language proficiency is required, and experience with GRC tools and security frameworks is essential. Success will come from formalizing supplier risk policies, integrating security requirements

Qualifications

• Knowledge of NIS2 and CyFun/NIST CSF.
• Experience in third-party risk management across supplier lifecycle.
• 2 years in energy or critical infrastructure sector.
• Coordinate with Purchasing, Legal, business lines and IT/Security teams.
• Document and optimize security processes and governance.
• GRC consulting/management experience.
• Security program or project management experience.
• Security consultant experience (3 years).
• Experience in information security risk analysis and monitoring of treatment plans.
• Maturity or compliance assessment on a control framework.
• Native or C2 level French.
• Facilitation of workshops, committees and steering-body reporting.
• Experience with security management techniques or frameworks (ISO-27000, COBIT, NIST, OWASP, CIS Controls).
• Experience defining or using GRC tools: inventory, questionnaires, risk register, action plans, reporting.

Skills

NIS2 knowledge

CyFun framework

NIST CSF

Third-party risk mgmt

Supplier lifecycle

Security governance

Security program mgmt

Security consulting

GRC consulting

Security risk analysis

Maturity assessment

Compliance assessment

Workshop facilitation

Committee reporting

EU/NIS2 compliance

ISO/27000 series

COBIT for Security

OWASP

CIS Controls

GRC tools (inventory, questionnaires,3

Tools

EBIOS

Job description

Steering and implementation mission of the third-party risk management program (TPRM) - NIS2 whose main responsibilities are as follows:

1- Finalization of the framing and governance

- Continue the definition and support the adoption of the TPRM governance model, associated roles and responsibilities.

- Contribute to the formalization of the third-party risk management policy, procedure, and framework.

- Assess the level of compliance with applicable NIS2/CyFun® requirements and contribute to the prioritization of compliance actions.

- Define and structure the tools necessary for the system: inventory, criticality criteria, impact and maturity questionnaires, risk register, action plans and reporting supports.

- Ensure the management of progress and reporting to the CISO and governance bodies.

2. Preparation and implementation of the system

- Contribute to the inventory of critical suppliers and the assessment of their criticality and their business and IT dependencies.

- Conduct or support supplier risk analyses, formalize risks and monitor treatment and remediation plans.

- Define a proportionate approach to the evaluation and monitoring of third parties, in line with their level of criticality and risk.

- Contribute to the definition and integration of security requirements into purchasing, project and contracting processes.

- Support the deployment of the system on pilot perimeters, in particular through risk analyses, supplier committees, the collection of evidence and, if necessary, targeted audits.

- Capitalize on pilots to improve the governance model, methods and tools.

3. Scaling up and cross-functional

coordination - Prepare for the gradual extension of the system to other critical suppliers, then to sensitive suppliers and new markets according to the scope chosen by the client.

- Work with the Purchasing, Legal, Data Protection, Projects, Processes and CISO teams to anchor the TPRM in existing processes and new markets.

- Facilitate workshops, interviews and committees with internal stakeholders and suppliers.

- Prepare clear summaries of progress, expected decisions, risks, action plans and open points.

- Contribute to the training and awareness of stakeholders in order to ensure the sustainability of the system.

MUST HAVE SKILLS:

• Knowledge of NIS2 and the CyFun® or NIST CSF framework


• Knowledge of third-party risk management practices over the supplier lifecycle


• Experience in the energy or critical infrastructure sector - 2 years


• Experience coordinating with Purchasing, Legal, business lines and IT/Security teams


• Demonstrable experience in analyzing, optimizing and documenting security processes and governance


• Demonstrable experience in cybersecurity GRC consulting or management


• Demonstrable experience in security program or project management


• Demonstrable experience as a security consultant - 3 years


• Experience in information security risk analysis and monitoring of treatment plans


• Experience in maturity or compliance assessment on a control framework


• Native or C2 level French


• Facilitation of workshops, committees and reporting to steering bodies


• Experience with the EBIOS methodology


• Demonstrable experience with security management techniques or frameworks (e.g., ISO-27000 series, COBIT for Security, NIST, OWASP, CIS Critical Security Controls for Effective Cyber Defense, ...)


• Experience in defining or using GRC tools: inventory, questionnaires, risk register, action plans and reporting