Cissp need 5 yr of job exp to aquire and you properly wun be hired as a management directly as a fresh grad.

If you are talking about vendor management, I would advise you to avoid. Basically anything related to security you will throw it to the vendor, while you are doing the pmo job. Plus this role dun really need you to have much security exp, basically any ppl can do it mean that you can be ezily replaceable

Some of my friends stuck in that role cos they learn nothing and is very hard for them to exit.