> Markdown version of [/jobs/ext/2340042-manager-third-party-ict-risk-tprm-dora-ref-2026-1434-manager](https://www.wearedevelopers.com/jobs/ext/2340042-manager-third-party-ict-risk-tprm-dora-ref-2026-1434-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Manager Third-Party & ICT Risk (TPRM / DORA) (Ref. : 2026-1434) - Manager - **Company:** KPMG - **Location:** Zaventem, Belgium (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Cyber Security, Information Security Management System - **Published:** August 5, 2026 - **Apply:** https://be.indeed.com/viewjob?jk=1d694069367b5eb6 ## About the Role Required * Approximately six or more years of experience in third-party and outsourcing risk, ICT risk or cyber risk, obtained within financial services, either in a first or second line function or in a consulting environment. Sector depth is valued above cross-sector breadth. * Demonstrable experience of DORA implementation. Candidates should be able to evidence concrete deliverables, such as a register of information that has withstood supervisory review, a criticality assessment methodology, or a contractual remediation programme, rather than theoretical familiarity with the regulation. * A substantive information security foundation, including the ability to assess a provider's information security management system, critically review SOC 2 Type II and ISAE 3402 reports, and distinguish between control deficiencies and documentation deficiencies. * Sound knowledge of IT risk management, covering ICT risk taxonomies, control frameworks (ISO/IEC 27001 and 27002, NIST CSF, CIS), risk appetite, key risk indicator design and board-level reporting. * Experience of leading repeatable service or team delivery, in addition to discrete project work. Professional proficiency in Dutch or French, combined with fluent English. Knowledge of the second national language is a significant advantage in this client base., * Dutch (Very good knowledge) * English (Very good knowledge) * French (Very good knowledge) ## Description Belgian banks, insurers and financial market infrastructures are subject to a continuous, supervised obligation to understand the services delivered by their ICT providers, the criticality of each arrangement, and the consequences of provider failure. The Digital Operational Resilience Act has shifted oversight of ICT third-party arrangements from a periodic compliance exercise to an ongoing control that supervisors actively assess. In practice, many institutions continue to manage this through manual processes and registers that are maintained infrequently and inconsistently. KPMG supports these institutions both through advisory engagements and through a managed service in which we operate defined elements of the third-party risk lifecycle on the client's behalf. We are seeking a Manager to lead delivery of this work and to contribute to the further development of the managed service within our cyber practice. * Lead TPRM engagements for institutions supervised by the NBB and the FSMA, covering target operating model design, register of information development and remediation, criticality and materiality assessments, contractual gap analysis, exit strategies, and concentration and subcontracting risk. * Assume responsibility for delivery quality within the TPRM managed service, including provider due diligence, continuous monitoring, assurance reviews and reporting to client risk committees. You will also contribute to the industrialisation of the service through the development of playbooks, tooling, delivery models, quality gates and commercial structure. * Support the growth of the service in collaboration with the partner group. This includes shaping the proposition, developing proposals and pricing, and building pipeline within existing client relationships. Commercial support will be provided, and an active contribution to business development is expected. * Translate supervisory requirements into operational processes. This includes DORA Chapter V and the associated RTS and ITS, the EBA outsourcing guidelines, EIOPA guidance and applicable NBB circulars, converted into arrangements that a second line function can realistically operate. * Coach and develop a team of consultants and senior consultants, and act as escalation point for technical and regulatory judgement. * Contribute to the practice's market presence through client roundtables, webinars, publications and engagement with the wider regulatory dialogue. ## Related Videos - [Local Candidates vs International Talent - Building the Very Best Dev Team](https://www.wearedevelopers.com/videos/1067-local-candidates-vs-international-talent-building-the-very-best-dev-team) - [Communicate efficiently with Software Architecture Diagrams](https://www.wearedevelopers.com/videos/379-communicate-efficiently-with-software-architecture-diagrams) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Best Companies in the Netherlands: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/193-best-companies-in-the-netherlands-top-25-companies-in-2023) - [Best Companies to Work For in Paris: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/190-best-companies-to-work-for-in-paris-top-25-companies-in-2023) - [Best Job Boards for Remote Work for Developers](https://www.wearedevelopers.com/magazine/290-best-job-boards-for-remote-work-for-developers) - [The Netherlands – Europe’s powerhouse for software development?](https://www.wearedevelopers.com/magazine/31-the-netherlands-europe-s-powerhouse-for-software-development) - [Software Developer Salary in The Netherlands [2023]](https://www.wearedevelopers.com/magazine/217-software-developer-salary-in-the-netherlands-2023) - [Best Companies to Work For in France: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/189-best-companies-to-work-for-in-france-top-25-companies-in-2023)