Third-Party Risk Management

Steering and implementation mission of the third-party risk management program (TPRM) - NIS2 whose main responsibilities are as follows:

1- Finalization of the framing and governance

- Continue the definition and support the adoption of the TPRM governance model, associated roles and responsibilities.

- Contribute to the formalization of the third-party risk management policy, procedure, and framework.

- Assess the level of compliance with applicable NIS2/CyFun® requirements and contribute to the prioritization of compliance actions.

- Define and structure the tools necessary for the system: inventory, criticality criteria, impact and maturity questionnaires, risk register, action plans and reporting supports.

- Ensure the management of progress and reporting to the CISO and governance bodies.

2. Preparation and implementation of the system

- Contribute to the inventory of critical suppliers and the assessment of their criticality and their business and IT dependencies.

- Conduct or support supplier risk analyses, formalize risks and monitor treatment and remediation plans.

- Define a proportionate approach to the evaluation and monitoring of third parties, in line with their level of criticality and risk.

- Contribute to the definition and integration of security requirements into purchasing, project and contracting processes.

- Support the deployment of the system on pilot perimeters, in particular through risk analyses, supplier committees, the collection of evidence and, if necessary, targeted audits.

- Capitalize on pilots to improve the governance model, methods and tools.

3. Scaling up and cross-functional

coordination - Prepare for the gradual extension of the system to other critical suppliers, then to sensitive suppliers and new markets according to the scope chosen by the client.

- Work with the Purchasing, Legal, Data Protection, Projects, Processes and CISO teams to anchor the TPRM in existing processes and new markets.

- Facilitate workshops, interviews and committees with internal stakeholders and suppliers.

- Prepare clear summaries of progress, expected decisions, risks, action plans and open points.

- Contribute to the training and awareness of stakeholders in order to ensure the sustainability of the system.

MUST HAVE SKILLS:

• Knowledge of NIS2 and the CyFun® or NIST CSF framework
• Knowledge of third-party risk management practices over the supplier lifecycle
• Experience in the energy or critical infrastructure sector - 2 years
• Experience coordinating with Purchasing, Legal, business lines and IT/Security teams
• Demonstrable experience in analyzing, optimizing and documenting security processes and governance
• Demonstrable experience in cybersecurity GRC consulting or management
• Demonstrable experience in security program or project management
• Demonstrable experience as a security consultant - 3 years
• Experience in information security risk analysis and monitoring of treatment plans
• Experience in maturity or compliance assessment on a control framework
• Native or C2 level French
• Facilitation of workshops, committees and reporting to steering bodies
• Experience with the EBIOS methodology
• Demonstrable experience with security management techniques or frameworks (e.g., ISO-27000 series, COBIT for Security, NIST, OWASP, CIS Critical Security Controls for Effective Cyber Defense, ...)
• Experience in defining or using GRC tools: inventory, questionnaires, risk register, action plans and reporting