Third Party Cyber Risk Lead

fca; Greater London; On-site; GBP 61,000 - 84,000; Full time

Job summary

FCA is seeking a capable Third Party Cyber Risk Lead within the Cyber Assurance team to shape and deliver the cyber risk approach for the FCA's supplier landscape. The role requires strategic leadership across onboarding, continuous monitoring, assessments and reporting.

The successful candidate will drive improvement in cyber risk processes, work with Procurement, Supplier Management and Incident Management, and influence regulatory and industry stakeholders.

Qualifications

• Deep understanding of Cyber Third Party Risk Management, including supplier risk assessments and continuous monitoring.
• Experience with risk-based decision-making and applying frameworks (e.g., NIST CSF).
• Ability to translate complex cyber risks into practical insights for technical and senior stakeholders.

Responsibilities

• Lead FCA's Third Party cyber risk program and provide assurance to senior stakeholders.
• Oversee supplier onboarding, continuous monitoring, risk-based assessments, and reporting.
• Manage incidents, risk escalation and stakeholder engagement across the supplier landscape.

Skills

Cyber risk management

Risk-based decision-making

AI-enabled tools

Job description

Job title: Third Party Cyber Risk Lead

Division: Operations

Department: Cyber & Information Resilience (C&IR) - Cyber Assurance

Salary: National (Edinburgh and Leeds) ranging from £60,700 to £75,600 and London from £66,600 to £83,000 (salary offered will be based on skills and experience). This role is graded as: Lead Associate - Regulatory

About the FCA and team

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you'll play a key part in protecting consumers, driving economic growth and shaping the future of UK finance services.

We are recruiting for a Third Party Cyber Risk Lead to join the Cyber Assurance team within the Cyber & Information Resilience (C&IR) department. C&IR is responsible for enabling secure regulation at the FCA and PSR.

This role leads the FCA's third-party cyber risk capability, with responsibility for shaping and delivering the cyber assurance approach for the FCA's supplier landscape. The role provides strategic and operational leadership across continuous monitoring, targeted cyber assessments, risk escalation and stakeholder engagement to ensure cyber risk arising from third parties is identified, assessed and managed effectively. It also drives continuous improvement in third-party cyber risk processes, tooling and reporting, working closely with internal partners such as Procurement, Supplier Management and Incident Management, as well as key external providers and industry stakeholders.

Role responsibilities

• Act as the FCA's cyber lead for Third Party Risk Management, setting strategy, providing assurance, risk insights and senior reporting to stakeholders including the CISO and CIO
• Lead the third-party cyber risk team in delivering the FCA's cyber assurance approach across supplier onboarding, continuous monitoring, risk-based assessments, escalation, reporting and AI-enabled risk management
• Oversee emerging third-party risks, including Agentic AI adoption and exposure management, ensuring risks are identified, assessed and managed before they become systemic
• Embed cyber risk within the FCA's supplier management and third-party risk frameworks, influencing stakeholders and aligning with the FCA, PRA and Bank of England Critical Third Party oversight regime
• Act as the cyber lead for third-party incidents, providing risk assessment, technical advice and support for supplier engagement, incident response and senior decision-making
• Drive continuous improvement of third-party cyber risk capabilities through process optimisation, tooling, horizon scanning, enhanced management information and assurance effectiveness
• Manage external assessment providers and cyber assurance partners, ensuring effective delivery, assessment quality, contract management and sub-processor and fourth-party oversight
• Translate complex cyber risks into clear business insight through reporting, metrics, KPIs and KRIs, enabling informed decision-making at management and committee level
• Build effective internal and external relationships, promoting a collaborative risk-based assurance model and representing the FCA across regulatory bodies, specialist networks and third-party cyber audit activities

Skills required

Minimum:

• Deep understanding of Cyber Third Party Risk Management, including supplier risk assessments, continuous monitoring, cyber assurance, risk-based decision-making and the application of frameworks such as NIST CSF 2.0
• Deep understanding of third-party cyber risk technologies, including analytical and AI-enabled tools that enhance monitoring, assessment quality and operational effectiveness
• Ability to translate complex cyber risks into clear, practical insights and recommendations for both technical and senior business stakeholders

Essential:

• Experience establishing and refining a Third Party Cyber Risk function, covering supplier risk assessments, ongoing monitoring, operating model development, and organizational capability building
• Effective stakeholder management and influencing skills, with experience challenging and guiding technical and business teams, implementing risk mitigation strategies and managing escalations across all levels of an organisation
• Broad understanding of supplier and supply chain risk management, including the interaction between cyber risk, procurement, supplier management, operational resilience, incident management and enterprise risk frameworks
• Experience leading and developing security professionals, including line management and technical coaching
• Experience producing meaningful cyber metrics, KPIs and KRIs to support risk oversight, reporting and senior decision-making
• Solid awareness of the external cyber risk landsca