Supply Chain Cyber Risk Leader

Heathrow Airport; City Of London; Hybrid; GBP 85,000 - 120,000; Full time

Benefits offered by this job

Hybrid working

Performance-based bonuses

Private health insurance

Pension scheme

Job summary

Heathrow Airport is seeking a Cyber Security Manager - Supply Chain to lead the supplier risk program, aligning with NCSC and ISO 27001 standards. You will assess, monitor and improve supplier security practices, embedding cyber requirements into contracts and onboarding.

The role involves collaboration with Procurement, Legal and Technology teams to reduce risk, strengthen resilience and promote a culture of cyber awareness across the extended enterprise.

Qualifications

• Proven experience in cyber security risk management in complex supply chains.
• Knowledge of ISO 27001, NIST and NCSC guidance.
• Experience with supplier security assessments and remediation activities.
• Excellent stakeholder management and communication skills.
• Professional certification such as CISSP, CISM, CRISC preferred.

Responsibilities

• Develop and implement supplier cyber risk management framework aligned with NCSC/ISO27001.
• Conduct supplier security assessments and drive remediation with stakeholders.
• Embed cyber security requirements in contracts and onboarding processes.
• Monitor supplier performance and report risk and compliance.
• Support incident response involving suppliers and capture lessons learned.

Skills

Cyber security risk management

Third-party risk management

ISO 27001

NIST guidance

NCSC guidance

Stakeholder management

Communication skills

Analytical mindset

Problem solving

Industry certifications

Job description

Heathrow Airport is seeking a Cyber Security Manager - Supply Chain to lead the supplier risk program, aligning with NCSC and ISO 27001 standards. You will assess, monitor and improve supplier security practices, embedding cyber requirements into contracts and onboarding.

The role involves collaboration with Procurement, Legal and Technology teams to reduce risk, strengthen resilience and promote a culture of cyber awareness across the extended enterprise.