Information Security Risk Management Specialist

WTW; London; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

A global risk management company is seeking an experienced Information Security Risk Management Specialist to safeguard its operations by identifying and managing information security risks across the supply chain. The role involves developing risk management strategies, conducting supplier security assessments, and ensuring compliance with industry standards. Ideal candidates possess strong experience in technology roles, professional qualifications in risk management, and excellent communication skills. This position offers a hybrid work model.

Qualifications

• Strong experience in technology role with proven experience of supplier risk management.
• Expertise in conducting supplier security risk assessments.
• Knowledge of Information Security Frameworks and standards (FFIEC, NIST, ISO, DORA).

Responsibilities

• Develop and implement risk management strategies.
• Perform in-depth supplier security assessments.
• Ensure compliance with industry standards and regulations.

Skills

Supplier risk management

Attention to detail

Excellent communication skills

Stakeholder management

Ability to assess information security risks

Education

Professional qualifications (CRISC, CISSP, CISM, CISA)

Job description

Drive Risk Awareness. Strengthen Supply Chain Security.

We’re looking for an experienced Information Security Risk Management Specialist to help safeguard WTW’s global operations by identifying and managing information security risks across our supply chain.

In this key role, you’ll be responsible for developing and implementing risk management strategies, performing in-depth supplier security assessments, and ensuring compliance with industry standards, regulatory requirements, and internal WTW policies.

You'll play a critical part in enhancing our third-party risk posture by working closely with internal teams and external partners to assess vulnerabilities, mitigate threats, and embed security best practices throughout the supply chain.

If you have a strong background in information security, risk management, and a passion for making businesses more resilient—we’d love to hear from you.

The Role

This role will support the ongoing operations of WTW Technology and Cyber Risk and Controls & Regulatory engagement function in:

• Evaluate supplier information security practices, policies and systems or risk exposure.
• Enhance risk assessment methodologies for supplier relationship management.
• Conduct thorough security assessments of suppliers to identify potential risks and vulnerabilities.
• Engage with procurement, legal and other stakeholder to integrate security requirements into supplier contracts.
• Collaborate with suppliers to develop and implement risk mitigation plans.
• Identify supplier risks and security gaps and support of tracking and remediation.
• Guide and support the Third-Party Security Assessment team with assessments and due diligence activities in line with Information and Cyber Security requirements.
• Provide guidance and support to internal teams on supplier risk management best practices.
• Stay up to date with the latest information security trends, threats, and technologies.
• Provide reports and recommendations to management on supplier risk and mitigation activities.
• Ensure adherence to relevant regulations, WTW standards, and industry best practices.

At WTW, we trust you to know your work and the people, tools and environment you need to be successful. The majority of our colleagues work in a ”hybrid” style, with a mix of remote, in-person and in office interactions dependent on the needs of the team, role and clients. Our flexibility is rooted in trust and “hybrid” is not a one-size-fits-all solution. We understand flexibility is key to supporting an inclusive and diverse workforce and so we encourage requests for all types of flexible working as well as location-based arrangements. Please speak to your recruiter to discuss more.

Qualifications

The Requirements

• Strong experience in technology role with proven experience of supplier risk management (for example, in projects, technical SME areas etc.).
• Hold professional qualifications in a related subject for example, CRISC, CISSP, CISM, CISA
• Experience of working within a global financial organization.
• Knowledge and experience of governance, risk and controls framework and related processes.
• Experience of technology, cyber risk and supply chain risk management.
• Experience and thorough understanding of technology and cyber controls processes.
• Expertise in conducting supplier security risk assessments.
• Attention to detail and a pre-emptive approach to identifying and mitigating risks.
• Ability to assess and manage information security risks effectively
• Detail-oriented and capable of delivering at a high level of accuracy.
• Proven ability to prioritise conflicting deadlines and priorities and respond quickly to changing priorities.
• Able to interpret & present data and information in the appropriate format for different audiences.
• Knowledge and understanding of Information Security Frameworks and standards (FFIEC, NIST, ISO, DORA etc.)
• Ability to work as part of a team or solo.
• Excellent Communication skills, especially written English
• Strong stakeholder management
• The ability to foster and grow relationships, constructive challenge and negotiation skills.
• Experience of working in a live operational environment with an understanding of the impact of policy adherence is desirable.

At WTW, we believe difference makes us stronger. We want our workforce to reflect the different and varied markets we operate in and to build a culture of inclusivity that makes colleagues feel welcome, valued and empowered to bring their whole selves to work every day. We are an equal opportunity employer committed to fostering an inclusive work environment throughout our organisation. We embrace all types of diversity.

We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email [e-mail].

You don't need to have an account in ATS to apply for the jobs. Once you click apply, get started right away by simply using your email. Your profile will be created and kept up to date automatically as you enter details for each of your job applications.