Third Party Cyber Risk Lead

• →Act as the FCA’s cyber lead for Third Party Risk Management, setting strategy, providing assurance, risk insights and senior reporting to stakeholders including the CISO and CIO
• →Lead the third-party cyber risk team in delivering the FCA’s cyber assurance approach across supplier onboarding, continuous monitoring, risk-based assessments, escalation, reporting and AI-enabled risk management
• →Oversee emerging third-party risks, including Agentic AI adoption and exposure management, ensuring risks are identified, assessed and managed before they become systemic
• →Embed cyber risk within the FCA’s supplier management and third-party risk frameworks, influencing stakeholders and aligning with the FCA, PRA and Bank of England Critical Third Party oversight regime
• →Act as the cyber lead for third-party incidents, providing risk assessment, technical advice and support for supplier engagement, incident response and senior decision-making
• →Drive continuous improvement of third-party cyber risk capabilities through process optimisation, tooling, horizon scanning, enhanced management information and assurance effectiveness
• →Manage external assessment providers and cyber assurance partners, ensuring effective delivery, assessment quality, contract management and sub-processor and fourth-party oversight
• →Translate complex cyber risks into clear business insight through reporting, metrics, KPIs and KRIs, enabling informed decision-making at management and committee level
• →Build effective internal and external relationships, promoting a collaborative risk-based assurance model and representing the FCA across regulatory bodies, specialist networks and third-party cyber audit activities

• Deep understanding of Cyber Third Party Risk Management, including supplier risk assessments, continuous monitoring, cyber assurance, risk-based decision-making and the application of frameworks such as NIST CSF 2.0
• Deep understanding of third-party cyber risk technologies, including analytical and AI-enabled tools that enhance monitoring, assessment quality and operational effectiveness
• Ability to translate complex cyber risks into clear, practical insights and recommendations for both technical and senior business stakeholders

• Experience establishing and refining a Third Party Cyber Risk function, covering supplier risk assessments, ongoing monitoring, operating model development, and organizational capability building
• Effective stakeholder management and influencing skills, with experience challenging and guiding technical and business teams, implementing risk mitigation strategies and managing escalations across all levels of an organisation
• Broad understanding of supplier and supply chain risk management, including the interaction between cyber risk, procurement, supplier management, operational resilience, incident management and enterprise risk frameworks
• Experience leading and developing security professionals, including line management and technical coaching
• Experience producing meaningful cyber metrics, KPIs and KRIs to support risk oversight, reporting and senior decision-making
• Solid awareness of the external cyber risk landscape, including emerging threats, regulatory developments, industry expectations and best practices relating to supplier security and resilience

Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference and supports colleagues to deliver at their best. We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation and delivers better regulation.

If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support.

We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part-time and job sharing where applicable.

Disability confident: our hiring approach
We’re proud to be a Disability Confident Employer and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes we may progress applicants whose experience most closely matches the role’s key requirements.

Useful information and timelines

Timeline:

• Job advert closes: 11:59pm, 25th October 2026
• CV Review/Shortlist: 27th October 2026
• Interview: w/c 2nd November 2026
• SC Clearance is required for this role (SC Guidance) - you will hold or will be required to obtain Security Check (SC) level vetting
• Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.