Cybersecurity TPRM Strategy and Governance SME

About the role

Hewlett Packard Enterprise is hiring for a Cybersecurity Third-Party Risk Management (TPRM) Strategy and Governance SME in San Juan, Puerto Rico. The role defines and advances the organization's third-party cybersecurity risk management strategy, operating model and governance framework, driving program maturity, efficiency and scalability. It is a hybrid position with about two days per week working from an HPE office.

Key responsibilities

• Develop and maintain the enterprise TPRM strategy and operating model, and define and continuously improve risk-based frameworks, methodologies, standards and procedures.
• Lead the evolution of vendor criticality, inherent risk, residual risk and due diligence frameworks.
• Identify opportunities to streamline, automate and optimize TPRM processes.
• Partner with Procurement, Legal, Compliance, Privacy, Supply Chain, IT and business stakeholders to align TPRM with business objectives and regulatory requirements.
• Establish metrics, KPIs and reporting frameworks, and lead assessments of TPRM tools and technology solutions.
• Provide thought leadership on emerging risks such as supply chain security, software supply chain risk, cloud providers, AI-related risks and operational resilience.
• Develop executive-level reporting and presentations, support enterprise-wide compliance and governance initiatives, and mentor less-experienced staff.

Required profile

• Bachelor's or Master's degree in Engineering, Computer Science, Information Security or equivalent.
• Typically 6-10 years of experience.
• Preferred certifications: CISSP, CRISC, CISM, CISA or equivalent.
• Experience implementing or optimizing TPRM or GRC platforms (e.g., OneTrust, Archer, ServiceNow).
• Knowledge of global regulations such as DORA, NIS2, GDPR and SEC Cybersecurity Rules.

Required skills

• In-depth knowledge of TPRM programs, frameworks and governance models.
• Strong knowledge of cybersecurity and risk frameworks such as NIST CSF, NIST 800-53, ISO 27001.
• Experience translating regulatory and security requirements into policies, standards and processes.
• Strong analytical, communication, stakeholder management and executive presentation skills, with mastery of English.