Cybersecurity TPRM Strategy & Governance Principal SME
About The Position
The Cybersecurity TPRM Strategy & Governance Principal SME defines and drives HPE's enterprise third-party cybersecurity risk strategy, governance, and operating framework. The role leads cybersecurity due diligence, supply chain cybersecurity, and operational resilience initiatives, ensuring compliance with evolving regulatory requirements such as DORA, NIS2, the EU Cyber Resilience Act (CRA), SEC Cybersecurity Rules, and other global regulations. The role provides thought leadership and strategic direction for designing, implementing, and continuously improving risk-based due diligence, vendor oversight, operational resilience, and supply chain cybersecurity programs. It influences executive decision-making, leads TPRM transformation initiatives, and drives scalable governance, automation, and technology solutions across the third-party lifecycle. The position is designed as onsite, with an expectation of primarily working from an HPE office.
Requirements
- Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, Engineering, or equivalent.
- Typically 10–15+ years of experience in cybersecurity, risk management, governance, regulatory compliance, or related disciplines.
- Significant experience designing, leading, and transforming enterprise Third-Party Risk Management (TPRM), Supply Chain Cybersecurity, or Governance, Risk, and Compliance (GRC) programs.
- Demonstrated experience driving enterprise-wide cybersecurity strategy, governance, regulatory compliance, and transformation initiatives.
- Industry certification such as CISSP, CISM, CRISC, or equivalent.
- Expert knowledge of TPRM, Supply Chain Cybersecurity, Cyber Supply Chain Risk Management (C-SCRM), and Cybersecurity Governance.
- Expertise in global cybersecurity regulations and regulatory frameworks, including DORA, NIS2, the EU Cyber Resilience Act (CRA), and emerging cyber and operational resilience requirements.
- Advanced knowledge of cybersecurity and risk frameworks, including NIST CSF, NIST 800-53, NIST SSDF, ISO 27001, ISO 22301, and industry best practices.
- Experience translating complex regulatory and cybersecurity requirements into enterprise policies, standards, governance frameworks, operating models, and scalable risk management processes.
- Ability to define and execute long-term cybersecurity strategy and influence organizational direction through executive engagement and thought leadership.
- Strong expertise in regulatory interpretation and impacts to third parties.
- Strong executive presence and exceptional stakeholder management, communication, presentation, and influencing skills.
- Proven experience influencing executive leadership and leading complex cross-functional programs.
- Demonstrated success leading enterprise transformation programs and driving measurable business outcomes through governance, innovation, and strategic leadership.
- Excellent written and verbal communication skills; mastery in English.
Responsibilities
- Lead third-party cybersecurity governance, regulatory and cybersecurity due diligence, and alignment with global requirements including DORA, NIS2, EU Cyber Resilience Act (CRA), GDPR, SEC Cybersecurity Rules, and emerging regulations.
- Provide senior-level expertise and leadership for complex third-party risk decisions.
- Design and drive enterprise cybersecurity due diligence frameworks, assessment methodologies, standards, and requirements supporting regulatory compliance, operational resilience, and third-party risk management.
- Lead the evolution of vendor criticality, inherent risk, residual risk, concentration risk, operational resilience, and continuous monitoring frameworks.
- Partner with Procurement, Legal, Compliance, Privacy, Internal Audit, Enterprise Risk Management, IT, Supply Chain, and business stakeholders to implement regulatory requirements and cybersecurity controls.
- Drive executive governance forums, regulatory readiness initiatives, and strategic decision-making concerning third-party cybersecurity risk and resilience.
- Evaluate emerging third-party risks involving artificial intelligence, cloud providers, software supply chains, critical infrastructure, geopolitical developments, and evolving threat landscapes.
- Lead enterprise-wide transformation initiatives to improve scalability, operational efficiency, user experience, and risk management effectiveness.
- Provide thought leadership and mentoring to less experienced staff members and cross-functional leads.
Benefits
- Comprehensive benefits supporting physical, financial, and emotional wellbeing.
- Career development programs to help employees pursue career goals, develop expertise, or apply skills in another division.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
