Cybersecurity TPRM Strategy & Governance Principal SME

Define and drive enterprise third-party cybersecurity risk strategy, governance, and operating practices for HPE.

Responsibilities

• Lead third-party cybersecurity governance, regulatory alignment, and cybersecurity due diligence across evolving global requirements, including DORA, NIS2, EU Cyber Resilience Act (CRA), GDPR, and SEC Cybersecurity Rules, plus emerging cybersecurity and operational resilience regulations.
• Provide senior expertise and leadership for complex third-party cybersecurity risk decisions.
• Design and drive organization-wide cybersecurity due diligence frameworks, assessment methodologies, standards, and requirements supporting regulatory compliance, operational resilience, and effective third-party risk management.
• Own the evolution of frameworks for vendor criticality, inherent risk, residual risk, concentration risk, operational resilience, and continuous monitoring.
• Partner with Procurement, Legal, Compliance, Privacy, Internal Audit, Enterprise Risk Management, IT, Supply Chain, and business stakeholders to implement regulatory requirements and cybersecurity controls.
• Drive executive governance forums, regulatory readiness efforts, and strategic decision-making for third-party cybersecurity risk and resilience.
• Evaluate emerging third-party risks across artificial intelligence, cloud providers, software supply chains, critical infrastructure, geopolitical developments, and evolving threat landscapes.
• Lead enterprise transformation initiatives to improve scalability, operational efficiency, user experience, and risk management effectiveness.
• Provide thought leadership and mentoring to less experienced staff members and other cross-functional leads.

Requirements

• Bachelor’s or Master’s degree in Computer Science, Information Security, Cybersecurity, Engineering, or equivalent.
• Typically 10-15+ years of experience in cybersecurity, risk management, governance, regulatory compliance, or related disciplines.
• Significant experience designing, leading, and transforming enterprise Third-Party Risk Management (TPRM), Supply Chain Cybersecurity, or Governance, Risk, and Compliance (GRC) programs.
• Proven experience driving enterprise-wide cybersecurity strategy, governance, regulatory compliance, and transformation initiatives.
• Industry certifications such as CISSP, CISM, CRISC, or equivalent.
• Expert knowledge of TPRM, Supply Chain Cybersecurity, Cyber Supply Chain Risk Management (C-SCRM), and cybersecurity governance.
• Expertise in global cybersecurity regulations and regulatory frameworks, including DORA, NIS2, EU Cyber Resilience Act (CRA), and emerging cyber and operational resilience requirements.
• Advanced knowledge of cybersecurity and risk frameworks: NIST CSF, NIST 800-53, NIST SSDF, ISO 27001, ISO 22301, and industry best practices.
• Demonstrated ability to translate complex regulatory and cybersecurity requirements into enterprise policies, standards, governance frameworks, operating models, and scalable risk management processes.
• Proven ability to define and execute long-term cybersecurity strategy and influence organizational direction through executive engagement and thought leadership.
• Strong expertise in regulatory interpretation and impact to third parties.
• Strong executive presence with exceptional stakeholder management, communication, presentation, and influencing skills.
• Proven experience influencing executive leadership and leading complex cross-functional programs.
• Demonstrated success leading enterprise transformation programs and driving measurable business outcomes through governance, innovation, and strategic leadership.
• Excellent written and verbal communication skills; mastery in English.

Technologies

• Third-Party Risk Management (TPRM)
• Supply Chain Cybersecurity
• Cyber Supply Chain Risk Management (C-SCRM)
• NIST CSF
• NIST 800-53
• NIST SSDF
• ISO 27001
• ISO 22301

Location and Work Model

• Spring, TX (onsite)

Compensation

• USD 140,000 - 321,000 per year (base salary)
• United States of America: Annual Salary USD 140,000 - 321,000 in Texas
• Variable incentives may be offered

Accessibility

• HPE is committed to creating an inclusive and accessible workplace and encourages applications from all qualified individuals, including those with disabilities.
• If you require accommodation during the application or interview process, submit your request via the secure form linked in the application instructions.
• This option is reserved for applicants needing assistance or reasonable accommodation related to a disability.

What HPE Can Offer

• Health & Wellbeing
• Personal & Professional Development
• Unconditional Inclusion

Job Details

• Job: Information Technology
• Job Level: Master

Recruitment Fraud Alert

• Hewlett Packard Enterprise (HPE) and authorized recruitment agencies/vendors will never charge a candidate a registration fee, hiring fee, or any other fee during the recruitment process.
• HPE never requests personal information such as bank account details, Social Security numbers, or national IDs via social media or chat applications.
• Legitimate job opportunities come through official company channels; verify the credentials of any third party claiming to represent HPE.
• If you suspect recruitment fraud, do not share personal information or make any payments, and report the incident to local authorities immediately.