Third Party Cyber Risk Lead

Financial Conduct Authority; Greater London; On-site; GBP 67,000 - 83,000; Full time

Benefits offered by this job

25 days annual leave

Private healthcare

Pension (8–12%)

Volunteering leave

Office working across London/Leeds/Edn

Job summary

The Financial Conduct Authority is recruiting a Third Party Cyber Risk Lead to head the FCA’s cyber assurance approach for its supplier landscape. You will provide strategic oversight, lead a team, and work with procurement, supplier management and incident management across the organisation.

Based in London with responsibilities spanning governance, risk reporting and horizon scanning, you will shape cyber risk controls for third parties and ensure effective risk management in the supplier

Qualifications

• Deep knowledge of Third Party Risk Management, supplier risk assessments, continuous monitoring and risk-based decision-making.
• Experience applying risk frameworks and translating cyber risk into actionable insights for senior stakeholders.
• Proven ability to lead and develop cyber risk capabilities and manage external assessment providers.

Responsibilities

• Act as the cyber lead for Third Party Risk Management, setting strategy and reporting to senior stakeholders.
• Lead the third-party cyber risk team across onboarding, monitoring, assessments, escalation and reporting.
• Drive improvement of third-party cyber risk processes, tooling and reporting.

Skills

Third party risk

Continuous monitoring

AI-enabled risk tools

Stakeholder management

Security leadership

Tools

NIST CSF 2.0

AI monitoring tools

Job description

Division: Operations

Department: Cyber & Information Resilience (C&IR) - Cyber Assurance

• This role is graded as: Lead Associate - Regulatory

Job title: Third Party Cyber Risk Lead

Division: Operations

Department: Cyber & Information Resilience (C&IR) - Cyber Assurance

Salary: National (Edinburgh and Leeds) ranging from £60,700 to £75,600 and London from £66,600 to £83,000 (salary offered will be based on skills and experience).

• This role is graded as: Lead Associate - Regulatory

About The FCA And Team

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth and shaping the future of UK finance services.

We are recruiting for a Third Party Cyber Risk Lead to join the Cyber Assurance team within the Cyber & Information Resilience (C&IR) department. C&IR is responsible for enabling secure regulation at the FCA and PSR.

This role leads the FCA’s third-party cyber risk capability, with responsibility for shaping and delivering the cyber assurance approach for the FCA’s supplier landscape. The role provides strategic and operational leadership across continuous monitoring, targeted cyber assessments, risk escalation and stakeholder engagement to ensure cyber risk arising from third parties is identified, assessed and managed effectively. It also drives continuous improvement in third-party cyber risk processes, tooling and reporting, working closely with internal partners such as Procurement, Supplier Management and Incident Management, as well as key external providers and industry stakeholders.

Role Responsibilities

• Act as the FCA’s cyber lead for Third Party Risk Management, setting strategy, providing assurance, risk insights and senior reporting to stakeholders including the CISO and CIO
• Lead the third-party cyber risk team in delivering the FCA’s cyber assurance approach across supplier onboarding, continuous monitoring, risk-based assessments, escalation, reporting and AI-enabled risk management
• Oversee emerging third-party risks, including Agentic AI adoption and exposure management, ensuring risks are identified, assessed and managed before they become systemic
• Embed cyber risk within the FCA’s supplier management and third-party risk frameworks, influencing stakeholders and aligning with the FCA, PRA and Bank of England Critical Third Party oversight regime
• Act as the cyber lead for third-party incidents, providing risk assessment, technical advice and support for supplier engagement, incident response and senior decision-making
• Drive continuous improvement of third-party cyber risk capabilities through process optimisation, tooling, horizon scanning, enhanced management information and assurance effectiveness
• Manage external assessment providers and cyber assurance partners, ensuring effective delivery, assessment quality, contract management and sub-processor and fourth-party oversight
• Translate complex cyber risks into clear business insight through reporting, metrics, KPIs and KRIs, enabling informed decision-making at management and committee level
• Build effective internal and external relationships, promoting a collaborative risk-based assurance model and representing the FCA across regulatory bodies, specialist networks and third-party cyber audit activities

Minimum

Skills required

• Deep understanding of Cyber Third Party Risk Management, including supplier risk assessments, continuous monitoring, cyber assurance, risk-based decision-making and the application of frameworks such as NIST CSF 2.0
• Deep understanding of third-party cyber risk technologies, including analytical and AI-enabled tools that enhance monitoring, assessment quality and operational effectiveness
• Ability to translate complex cyber risks into clear, practical insights and recommendations for both technical and senior business stakeholders

Essential

• Experience establishing and refining a Third Party Cyber Risk function, covering supplier risk assessments, ongoing monitoring, operating model development, and organizational capability building
• Effective stakeholder management and influencing skills, with experience challenging and guiding technical and business teams, implementing risk mitigation strategies and managing escalations across all levels of an organisation
• Broad understanding of supplier and supply chain risk management, including the interaction between cyber risk, procurement, supplier management, operational resilience, incident management and enterprise risk frameworks
• Experience leading and developing security professionals, including line management and technical coaching
• Experience producing meaningful cyber metrics, KPIs and KRIs to support risk oversight, reporting and senior decision-making
• Solid awareness of the external cyber risk landscape, including emerging threats, regulatory developments, industry expectations and best practices relating to supplier security and resilience

Benefits

• 25 days annual leave plus bank holidays
• Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
• Private healthcare with Bupa, income protection and 24/7 Employee Assistance
• 35 hours of paid volunteering annually
• Colleagues spend a minimum of 50% of their working time in the office each month (60% for Directors and Executive Directors) across our London, Leeds and Edinburgh offices. A flexible benefits scheme designed around your lifestyle

For a full list of our benefits and our recruitment process as a whole visit our benefits page.

Our values and culture

Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference and supports colleagues to deliver at their best. We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation and delivers better regulation.

If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support.

We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part-time and job sharing where applicable.

Disability confident: our hiring approach

We’re proud to be a Disability Confident Employer and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes we may progress applicants whose experience most closely matches the role’s key requirements.

Useful information and timelines

Timeline

• Job advert closes: 11:59pm, 25th October 2026
• CV Review/Shortlist: 27th October 2026
• Interview: w/c 2nd November 2026
• SC Clearance is required for this role (SC Guidance) - you will hold or will be required to obtain Security Check (SC) level vetting
• Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.