Cyber Supply Chain Risk & Assurance Specialist

Cyber Supply Chain Risk & Assurance Specialist

• Design and implement Cyber Supply Chain Risk Management (C-SCRM) frameworks
• Drive third-party cyber risk and supplier security assurance programmes
• Work across Information Security, Procurement, Legal, Risk and Technology teams

We're seeking a Cyber Supply Chain Risk & Assurance Specialist to support the development and implementation of a mature third-party cyber risk and supplier security assurance capability.

This role is focused on identifying, assessing and managing cyber risks arising from suppliers, vendors, cloud providers and other third parties, helping strengthen organisational resilience and security across the broader supply chain.

Working closely with Information Security, Procurement, Legal, Risk and Business stakeholders, you'll be responsible for designing and embedding supplier security frameworks, conducting supplier risk assessments, developing assurance processes and ensuring cyber security requirements are integrated throughout the supplier lifecycle.

This is a hands-on role that requires someone who has successfully delivered C-SCRM or third-party cyber risk programmes in practice, rather than someone with only theoretical or advisory experience.

This opportunity will suit a cyber security professional who enjoys building capability from the ground up, working across multiple stakeholder groups and driving meaningful security outcomes across complex supplier ecosystems.

Key Responsibilities

• Design, implement and mature Cyber Supply Chain Risk Management (C-SCRM) frameworks, processes and operating models
• Develop supplier security assurance and third-party cyber risk management capabilities
• Conduct supplier cyber security assessments, due diligence reviews and risk evaluations
• Define supplier classification, criticality and risk-based assurance methodologies
• Develop and maintain cyber security requirements for suppliers, vendors and technology partners
• Work with Procurement and Legal teams to embed security requirements into RFIs, RFPs, contracts and supplier onboarding processes
• Assess and manage third-party and fourth-party cyber risks across the supplier ecosystem
• Establish supplier risk reporting, governance, metrics and executive reporting capabilities
• Integrate supplier cyber risks into Enterprise Risk Management frameworks and processes
• Support remediation planning and risk treatment activities with suppliers and internal stakeholders
• Develop policies, standards, templates and assessment methodologies supporting supplier security assurance
• Drive continuous improvement across third-party cyber risk and supplier assurance programmes

About You

• Previous experience delivering Cyber Supply Chain Risk Management (C-SCRM), Third-Party Cyber Risk or Supplier Security Assurance programmes
• Demonstrated experience designing and implementing supplier cyber risk frameworks and operating models
• Strong understanding of NIST C-SCRM, NIST Cybersecurity Framework, ISO 27001 or comparable security frameworks
• Experience developing risk-based supplier assurance, due diligence and security assessment processes
• Experience defining and implementing cyber security requirements for suppliers and technology vendors
• Strong understanding of third-party and fourth-party cyber risks, including cloud services, SaaS platforms, vendor-managed solutions and external access models
• Experience working closely with Procurement, Legal, Risk, Privacy and Technology stakeholders
• Strong communication and stakeholder engagement skills
• Ability to balance security requirements with practical business outcomes
• Relevant certifications such as CISSP, CISM, CRISC, CISA or similar are highly regarded

All applications are confidential.

For more information, apply directly or contact Holly Greenwood at holly@evolverecruitment.co.nz or 021 216 2940.