Cybersecurity TPRM Strategy & Governance Principal SME

About the Role 

The Cybersecurity TPRM Strategy & Governance Principal SME defines and drives HPE's enterprise third-party cybersecurity risk strategy, governance, and operating framework. The role leads cybersecurity due diligence, supply chain cybersecurity, and operational resilience initiatives while ensuring compliance with evolving regulatory requirements including DORA, NIS2, EU Cyber Resilience Act (CRA), SEC Cybersecurity Rules, and emerging global regulations.

About You 

You will be responsible for providing thought leadership and strategic direction for the design, implementation, and continuous improvement of risk-based due diligence, vendor oversight, operational resilience, and supply chain cybersecurity programs. This role influences executive decision-making, leads TPRM transformation initiatives, and drives adoption of scalable governance, automation, and technology solutions that enhance cybersecurity risk management across the third-party lifecycle. 

 Responsibilities 

• Serve as the lead for third-party cybersecurity governance, regulatory and cybersecurity due diligence, ensuring alignment with evolving global requirements, including DORA, NIS2, EU Cyber Resilience Act (CRA), GDPR, SEC Cybersecurity Rules, and emerging cybersecurity and operational resilience regulations. 

• Provide senior-level expertise and leadership for complex risk decisions related to third parties. 

• Design and drive organization-wide cybersecurity due diligence frameworks, assessment methodologies, standards, and requirements that support regulatory compliance, operational resilience, and effective third-party risk management. 

• Lead the evolution of vendor criticality, inherent risk, residual risk, concentration risk, operational resilience, and continuous monitoring frameworks. 

• Partner with Procurement, Legal, Compliance, Privacy, Internal Audit, Enterprise Risk Management, IT, Supply Chain, and business stakeholders to drive regulatory requirements and cybersecurity controls. 

• Drive executive governance forums, regulatory readiness initiatives, and strategic decision-making related to third-party cybersecurity risk and resilience. 

• Evaluate third party emerging risks related to artificial intelligence, cloud providers, software supply chains, critical infrastructure, geopolitical developments, and evolving threat landscapes. 

• Drive enterprise-wide transformation initiatives that improve scalability, operational efficiency, user experience, and risk management effectiveness. 

• Provide thought leadership, mentoring, to less experienced staff members and other cross functional leads. 

Education and Experience Required 

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, Engineering, or equivalent. 

• Typically, 10-15+ years of experience in cybersecurity, risk management, governance, regulatory compliance, or related disciplines. 

• Significant experience in designing, leading, and transforming enterprise Third-Party Risk Management (TPRM), Supply Chain Cybersecurity, or Governance, Risk, and Compliance (GRC) programs. 

• Demonstrated experience driving enterprise-wide cybersecurity strategy, governance, regulatory compliance, and transformation initiatives. 
• Industry certifications such as CISSP, CISM, CRISC, or equivalent. 

• Expert knowledge of Third-Party Risk Management (TPRM), Supply Chain Cybersecurity, Cyber Supply Chain Risk Management (C-SCRM), and Cybersecurity Governance.
• Expertise in global cybersecurity regulations and regulatory frameworks, including DORA, NIS2, EU Cyber Resilience Act (CRA), and emerging cyber and operational resilience requirements.
• Advanced knowledge of cybersecurity and risk frameworks, including NIST CSF, NIST 800-53, NIST SSDF, ISO 27001, ISO 22301, and industry best practices.
• Demonstrated experience translating complex regulatory and cybersecurity requirements into enterprise policies, standards, governance frameworks, operating models, and scalable risk management processes.
• Proven ability to define and execute long-term cybersecurity strategy and influence organizational direction through executive engagement and thought leadership.
• Strong expertise in regulatory interpretation and impact to third parties.
• Strong executive presence with exceptional stakeholder management, communication, presentation, and influencing skills.
• Proven experience influencing executive leadership and leading complex cross-functional programs. 
• Demonstrated success leading enterprise transformation programs and driving measurable business outcomes through governance, innovation, and strategic leadership.
• Excellent written and verbal communication skills; mastery in English.

HPE is committed to creating an inclusive and accessible workplace and encourages applications from all qualified individuals, including those with disabilities. If you believe you require accommodation during any stage of the application or interview process, please submit your request by completing our secure form linked here.

Note: This option is reserved for applicants needing assistance/reasonable accommodation related to a disability.

We strive to provide our team members and their loved ones with a comprehensive suite of benefits that supports their physical, financial and emotional wellbeing.

We also invest in your career because the better you are, the better we all are. We have specific programs catered to helping you reach any career goals you have — whether you want to become a knowledge expert in your field or apply your skills to another division.

We are unconditionally inclusive in the way we work and celebrate individual uniqueness. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good.

Information about employee benefits offered in the US can be found at https://myhperewards.com/main/new-hire-enrollment.html

HPE will comply with all applicable laws related to employer use of arrest and conviction records, including laws requiring employers to consider for employment qualified applicants with criminal histories.

We have become aware of an increase in fraudulent recruitment activities in which individuals impersonate our company or authorized recruitment agencies to offer fake employment opportunities. These scams may occur through false websites, emails, social media, or chat-based applications and often aim to obtain personal information or money. Please note that Hewlett Packard Enterprise (HPE), its direct and indirect subsidiaries and affiliated companies, and its authorized recruitment agencies/vendors will never charge a candidate a registration fee, hiring fee, or any other fee in connection with its recruitment and hiring process. We also never request personal information such as back account details, Social Security numbers, or national IDs via social media or chat applications.

All legitimate job opportunities will come through official company channels, and candidates are responsible for verifying the credentials of any third party claiming to represent the company. Any reliance on fraudulent communication is at the individual’s own risk, and HPE disclaims legal liability for any resulting damages. If you suspect recruitment fraud, do not share personal information or make any payments and report the incident to your local authorities immediately.