Third-Party Risk Management

pSteering and implementation mission of the third-party risk management program (TPRM)
- NIS2 whose main responsibilities are as follows: /p /brp1
- Finalization of the framing and governance /p /brp
- Continue the definition and support the adoption of the TPRM governance model, associated roles and responsibilities. /p /brp
- Contribute to the formalization of the third-party risk management policy, procedure, and framework. /p /brp
- Assess the level of compliance with applicable NIS2/CyFun® requirements and contribute to the prioritization of compliance actions. /p /brp
- Define and structure the tools necessary for the system: inventory, criticality criteria, impact and maturity questionnaires, risk register, action plans and reporting supports. /p /brp
- Ensure the management of progress and reporting to the CISO and governance bodies. /p /brp2. Preparation and implementation of the system /p /brp
- Contribute to the inventory of critical suppliers and the assessment of their criticality and their business and IT dependencies. /p /brp
- Conduct or support supplier risk analyses, formalize risks and monitor treatment and remediation plans. /p /brp
- Define a proportionate approach to the evaluation and monitoring of third parties, in line with their level of criticality and risk. /p /brp
- Contribute to the definition and integration of security requirements into purchasing, project and contracting processes. /p /brp
- Support the deployment of the system on pilot perimeters, in particular through risk analyses, supplier committees, the collection of evidence and, if necessary, targeted audits. /p /brp
- Capitalize on pilots to improve the governance model, methods and tools. /p /brp3. Scaling up and cross-functional /p /brpcoordination
- Prepare for the gradual extension of the system to other critical suppliers, then to sensitive suppliers and new markets according to the scope chosen by the client. /p /brp
- Work with the Purchasing, Legal, Data Protection, Projects, Processes and CISO teams to anchor the TPRM in existing processes and new markets. /p /brp
- Facilitate workshops, interviews and committees with internal stakeholders and suppliers. /p /brp
- Prepare clear summaries of progress, expected decisions, risks, action plans and open points. /p /brp
- Contribute to the training and awareness of stakeholders in order to ensure the sustainability of the system. /p /brh3MUST HAVE

SKILLS:
/h3 /brul /brliKnowledge of NIS2 and the CyFun® or NIST CSF framework /li /brliKnowledge of third-party risk management practices over the supplier lifecycle /li /brliExperience in the energy or critical infrastructure sector
- 2 years /li /brliExperience coordinating with Purchasing, Legal, business lines and IT/Security teams /li /brliDemonstrable experience in analyzing, optimizing and documenting security processes and governance /li /brliDemonstrable experience in cybersecurity GRC consulting or management /li /brliDemonstrable experience in security program or project management /li /brliDemonstrable experience as a security consultant
- 3 years /li /brliExperience in information security risk analysis and monitoring of treatment plans /li /brliExperience in maturity or compliance assessment on a control framework /li /brliNative or C2 level French /li /brliFacilitation of workshops, committees and reporting to steering bodies /li /brliExperience with the EBIOS methodology /li /brliDemonstrable experience with security management techniques or frameworks (e.g., ISO-27000 series, COBIT for Security, NIST, OWASP, CIS Critical Security Controls for Effective Cyber Defense, ...) /li /brliExperience in defining or using GRC tools: inventory, questionnaires, risk register, action plans and reporting /li /br /ul