Job Search

We are seeking an experienced Third Party Cyber Risk Lead to strengthen the management of cyber security risks across a complex network of suppliers, partners and outsourced service providers. This is a key role responsible for ensuring that third parties meet appropriate security expectations throughout the procurement, onboarding, monitoring and offboarding lifecycle.

You will develop and maintain a proportionate third-party cyber risk management framework, including security standards, assessment methodologies, risk-rating criteria and assurance requirements. Working closely with procurement, legal, technology, information security and business stakeholders, you will assess supplier risks, identify control gaps and agree practical remediation plans. You will also provide clear advice on risk acceptance, mitigation and escalation where appropriate.

Key responsibilities will include leading security due diligence for new and existing suppliers; reviewing independent assurance reports, certifications and technical evidence; overseeing risk assessments and remediation activities; maintaining accurate records and management information; and producing regular reports for senior stakeholders and relevant governance forums. You will monitor changes in the threat landscape, regulatory expectations and supplier services, ensuring that the third-party risk approach remains effective and current.

The successful candidate will have substantial experience in third-party, supplier or technology risk, with a strong understanding of cyber security principles, information security controls and risk management practices. Experience of assessing cloud providers, managed service providers and other critical suppliers would be advantageous. You should be comfortable interpreting frameworks and standards such as ISO 27001, NIST, CIS or equivalent, and familiar with security questionnaires, assurance reports and contractual security requirements.

Strong communication and influencing skills are essential, as you will need to challenge constructively, explain complex issues clearly and build effective relationships at all levels. Relevant professional qualifications in cyber security, information security, audit or risk are desirable. This role offers the opportunity to shape a mature third-party cyber risk capability and make a direct contribution to organisational resilience.

We are seeking an experienced Third Party Cyber Risk Lead to develop and oversee a robust approach to managing cyber security risks across suppliers, partners and other external service providers. This role will play a key part in strengthening organisational resilience by ensuring that third parties are appropriately assessed, monitored and managed throughout the supplier lifecycle.

You will establish and maintain the third-party cyber risk management framework, including policies, standards, processes and risk assessment methodologies. Working closely with procurement, legal, technology, information security and business stakeholders, you will provide expert guidance during supplier selection, onboarding, contract renewal and exit activities. Your responsibilities will include leading risk assessments, reviewing security questionnaires and independent assurance reports, identifying control gaps, agreeing remediation plans and escalating material risks where necessary. You will also define risk-based requirements for suppliers, support contract negotiations and ensure that appropriate security clauses, audit rights and incident notification provisions are included.

The successful candidate will maintain accurate risk registers and management information, producing clear reporting for senior stakeholders and relevant governance forums. You will monitor emerging threats, regulatory expectations and changes in the external supplier landscape, using these insights to improve oversight and prioritise assurance activity. Experience of third-party or supply-chain cyber risk management within a complex environment is essential, along with a strong understanding of information security controls, risk management principles and recognised frameworks such as ISO 27001, NIST or equivalent. You should be confident influencing stakeholders at all levels, challenging constructively and translating technical risk into clear business language. Relevant professional qualifications, such as CISSP, CISM, CRISC or a recognised supplier risk certification, would be advantageous.

We are seeking an experienced Third Party Cyber Risk Lead to strengthen the management of cyber security risks arising from suppliers, partners and other external service providers. This role will lead the development and delivery of a robust third-party cyber risk management framework, ensuring that external relationships are assessed consistently and managed in line with relevant security standards, regulatory expectations and internal risk appetite.

You will oversee the end-to-end assessment lifecycle, from initial due diligence and inherent risk profiling through to control validation, remediation tracking and ongoing monitoring. Working closely with procurement, legal, technology, information security and business stakeholders, you will provide clear, practical advice on supplier risks and support informed decisions throughout the engagement lifecycle. Responsibilities will include maintaining risk and assessment records, reviewing independent assurance reports and security questionnaires, challenging responses where appropriate, escalating material concerns and producing meaningful management information for senior stakeholders and governance forums.

The successful candidate will have significant experience in third-party cyber security, supplier assurance, technology risk or a closely related discipline, ideally within a complex or regulated environment. You will have a strong understanding of security frameworks and controls, such as ISO 27001, NIST, CIS or equivalent, together with experience assessing cloud, software and outsourced service providers. Excellent analytical, communication and influencing skills are essential, as is the ability to translate technical risks into clear business language and drive remediation across multiple stakeholders. Relevant professional qualifications, such as CISA, CRISC, CISSP or a recognised third-party risk certification, would be advantageous. This is an opportunity to shape a mature cyber risk capability and make a visible contribution to the organisation’s resilience and security posture.

We are seeking an experienced Third Party Cyber Risk Lead to strengthen the management of information and cyber security risks across an organisation’s supplier and partner ecosystem. This is a key role within the wider risk function, responsible for ensuring that third parties are assessed, monitored and managed consistently throughout the relationship lifecycle. You will provide expert guidance to procurement, technology, legal, compliance and business teams, helping them make informed decisions about supplier security and resilience.

Your responsibilities will include developing and maintaining the third-party cyber risk management framework, policies, standards and procedures. You will lead or oversee security due diligence for new and existing suppliers, reviewing assessments, certifications, audit reports, contractual controls and remediation plans. You will identify and evaluate risks associated with critical and high-risk suppliers, maintain accurate risk records, and provide clear recommendations to stakeholders and senior management. You will also establish appropriate monitoring arrangements, track control effectiveness, challenge exceptions and ensure that agreed actions are completed within defined timescales.

The successful candidate will have substantial experience in third-party risk, supplier assurance, cyber security, information security or a closely related discipline. You will be confident interpreting technical and governance evidence, including ISO 27001, SOC reports, penetration testing results, business continuity arrangements and data protection requirements. Strong knowledge of recognised security and risk frameworks, such as NIST, CIS or ISO standards, would be advantageous. Excellent communication and influencing skills are essential, as you will need to translate complex cyber risks into clear, practical business advice and build effective relationships at all levels. A proactive, analytical and collaborative approach is required, together with the ability to manage competing priorities and work independently. Relevant professional qualifications in cyber security, information risk, audit or supplier management would be welcomed.

We are seeking an experienced Third Party Cyber Risk Lead to strengthen the management of cyber security risks across a complex supplier and partner ecosystem. In this role, you will develop and oversee a proportionate third-party cyber risk management framework, helping ensure that suppliers meet security expectations throughout the procurement, onboarding, monitoring, renewal and offboarding lifecycle. You will work closely with procurement, legal, information security, technology, risk and business stakeholders to embed effective controls and provide clear, practical advice.

Your responsibilities will include conducting and overseeing supplier cyber risk assessments, reviewing security questionnaires and independent assurance reports, identifying control gaps, and agreeing remediation plans with relevant stakeholders. You will maintain accurate risk and issue records, monitor remediation progress, support risk acceptance decisions, and produce meaningful management information for governance forums and senior leadership. You will also contribute to the development of policies, standards, procedures and guidance, while helping to improve third-party security requirements, due diligence processes and ongoing monitoring activities. Where required, you will support incident response and investigations involving suppliers, ensuring lessons learned are incorporated into risk management practices.

The successful candidate will have strong experience in third-party, supplier or technology risk, ideally within a regulated, highly controlled or complex environment. You will understand information security principles, common cyber threats, risk assessment methodologies and relevant control frameworks such as ISO 27001, NIST, CIS or equivalent. Experience interpreting SOC reports, penetration testing results, business continuity evidence and other assurance materials is desirable. Strong stakeholder management and communication skills are essential, as is the ability to explain technical and risk matters clearly to both specialist and non-specialist audiences. You should be organised, commercially aware, confident challenging decisions constructively, and capable of managing competing priorities while delivering high-quality outcomes.

We are seeking an experienced Third Party Cyber Risk Lead to strengthen the management of cyber security risks across our external supplier and partner ecosystem. In this role, you will lead the development and delivery of a robust third-party cyber risk management programme, helping ensure that suppliers meet required security, resilience, privacy and regulatory standards. You will work closely with procurement, legal, technology, information security, risk and business teams to embed effective controls throughout the supplier lifecycle.

Your responsibilities will include defining and maintaining third-party cyber risk policies, standards, procedures and assessment methodologies; conducting risk assessments and due diligence for new and existing suppliers; reviewing security questionnaires, audit reports, certifications and remediation plans; and identifying control gaps requiring further action. You will monitor supplier risk profiles, oversee remediation activity and escalate material risks appropriately. You will also support contract negotiations by advising on security requirements, incident notification provisions, audit rights, data protection obligations and business continuity expectations.

The successful candidate will have proven experience in third-party risk management, supplier assurance, cyber security governance or a related discipline, ideally within a complex or highly regulated environment. You should have a strong understanding of recognised security and risk frameworks, such as ISO 27001, NIST, CIS Controls, SOC 2 or equivalent, together with knowledge of cloud security, data protection, operational resilience and cyber incident management. Strong analytical, communication and stakeholder management skills are essential, as is the ability to challenge constructively and influence at all levels. Relevant professional qualifications, such as CISA, CRISC, CISSP, CISM or equivalent experience, would be advantageous. This is an opportunity to play a key role in improving organisational resilience and reducing cyber risk across a diverse and critical third-party landscape.