Senior Cyber Third-Party Risk Manager

Tesco; Reigate; Hybrid; GBP 72,200 - 86,640; Full time

Benefits offered by this job

Annual bonus

Hybrid working

Pension scheme

Colleague discounts

Job summary

Tesco Insurance is seeking a skilled Third Party Risk Manager - Cyber to lead the design and operation of our third-party cyber risk program across multiple UK locations. You will drive risk assessments, supplier assurance activities, and reporting in line with risk appetite and regulatory expectations.

The role requires strong governance, collaboration with Procurement, Legal, and Technology, and the ability to steer risk treatment decisions in a complex environment.

Qualifications

• Experience in cyber security and third-party risk management
• Ability to assess supplier risk and provide defensible assurance
• Strong stakeholder influence with cross-functional teams
• Understanding of regulatory expectations and assurance activities

Responsibilities

• Own and evolve the cyber third-party risk management framework and processes.
• Lead cyber risk assessments of suppliers, partners, and third parties, including high-risk suppliers.
• Oversee supplier assurance activity: questionnaires, evidence reviews, attestations, and audits.
• Ensure cyber risks are clearly articulated, scored, and tracked with treatment plans.
• Act as primary contact for cyber third-party risk during audits and regulatory reviews.
• Collaborate with Procurement, Legal, Technology, and Data Protection teams to drive risk treatment.
• Produce reporting on supplier cyber risk posture and trends.

Skills

Third-party cyber risk

Cyber risk assessment

Stakeholder management

Regulatory knowledge

Job description

Tesco Insurance is seeking a skilled Third Party Risk Manager - Cyber to lead the design and operation of our third-party cyber risk program across multiple UK locations. You will drive risk assessments, supplier assurance activities, and reporting in line with risk appetite and regulatory expectations.

The role requires strong governance, collaboration with Procurement, Legal, and Technology, and the ability to steer risk treatment decisions in a complex environment.