Third Party Cyber Risk Lead

In this role you lead the FCA’s third-party cyber risk capability, shaping and delivering the cyber assurance approach for the supplier landscape. You will provide strategic direction and operational leadership across monitoring, assessments, escalation, and reporting, ensuring third-party risks are identified and managed. You’ll collaborate with Procurement, Supplier Management and Incident Management to improve processes, tooling and governance. Your work directly supports secure regulation and cross‑agency resilience in UK financial services.

• 25 days annual leave plus bank holidays
• Non-contributory pension 8–12% and life assurance
• Private healthcare with Bupa, income protection and EAP
• 35 hours of paid volunteering annually
• Office work mix London/Leeds/Edinburgh
• Flexible benefits scheme

• Set strategy as the FCA’s cyber lead for Third Party Risk Management and provide assurance and reporting to senior stakeholders
• Lead the third-party cyber risk team across onboarding, continuous monitoring, risk-based assessments, escalation, reporting and AI-enabled risk management
• Oversee emerging third-party risks including Agentic AI adoption and exposure management to prevent systemic issues
• Embed cyber risk within supplier management and third-party risk frameworks across FCA, PRA and Bank of England regimes
• Act as cyber lead for third-party incidents with risk assessment, technical advice and senior decision support
• Drive continuous improvement of third-party cyber risk capabilities through processes, tooling, horizon scanning and enhanced reporting
• Manage external assessment providers and cyber assurance partners with a focus on delivery quality and contract oversight
• Translate complex cyber risks into actionable business insights via metrics, KPIs and KRIs for management and committees
• Build internal/external relationships to promote a collaborative risk-based assurance model and represent FCA externally

• Deep understanding of Cyber Third Party Risk Management including supplier risk assessments and continuous monitoring
• Understanding of third-party cyber risk technologies and AI-enabled tools
• Ability to translate complex cyber risks into practical insights for technical and senior stakeholders
• Experience establishing/refining a Third Party Cyber Risk function (operating model, capability building)
• Effective stakeholder management and influencing skills across all organisational levels
• Broad understanding of supplier and supply chain risk management and related frameworks
• Experience leading and developing security professionals including coaching
• Experience producing cyber metrics, KPIs and KRIs for risk oversight and reporting
• Awareness of external cyber risk landscape, regulatory developments and industry best practices in supplier security

• stakeholder management
• influencing and communication
• ability to challenge and guide technical and business teams
• NIST CSF 2.0
• analytical and AI-enabled risk monitoring tools
• risk-based decision-making