Strategic Information Security Officer – Third-Party Risk

PostNL; Den Haag; Hybrid; EUR 51,000 - 73,000; Full time

Benefits offered by this job

Hybrid working model

8% holiday pay

25 holiday days

Health insurance

Pension

NS Business Card

Training and development

Job summary

PostNL is seeking an Information Security Officer focused on Third-Party Risk Management. You will manage cyber risk across suppliers and partnerships, ensuring assessments, onboarding, and reassessments meet security requirements while enabling business goals.

You will collaborate with IT, legal, and business stakeholders, shaping risk mitigation and compliance programs within a large, regulated organization.

Qualifications

• Bachelor or Master degree in IT, Cybersecurity, Risk Management or Business Administration.
• 3–6+ years of relevant experience in Information Security or Third-Party Risk Management.
• Experience with supplier risk assessments and vendor security governance.

Responsibilities

• Perform third-party security risk assessments, including due diligence, onboarding, and periodic reassessments.
• Evaluate supplier compliance against ISO 27001, NIST CSF, and internal security policies.
• Define, coordinate, and monitor mitigation plans with business owners and suppliers.
• Support audits and evidence gathering related to supplier security and compliance.
• Balance risk mitigation, regulatory compliance, and operational feasibility.

Skills

Stakeholder management

Cybersecurity expertise

Third-party risk assessments

Regulatory frameworks knowledge

Education

Bachelor or Master in IT/Cybersecurity/Risk Management/Business Administration

Tools

ISO27001

NIST CSF

CIS Controls

Audit processes

Job description

PostNL is seeking an Information Security Officer focused on Third-Party Risk Management. You will manage cyber risk across suppliers and partnerships, ensuring assessments, onboarding, and reassessments meet security requirements while enabling business goals.

You will collaborate with IT, legal, and business stakeholders, shaping risk mitigation and compliance programs within a large, regulated organization.