Third Party Cyber Risk Lead

PSR Limited; Greater London; On-site; GBP 61,000 - 84,000; Full time

Benefits offered by this job

35 hours of paid volunteering annually

Private healthcare with Bupa

Non-contributory pension (8–12%)

Job summary

Financial Conduct Authority is seeking a Lead for Third Party Cyber Risk within the Cyber Assurance team. You will shape and deliver the cyber assurance approach for the FCA’s supplier landscape, providing strategic and operational leadership across monitoring, assessments, escalation and reporting.

The role requires deep knowledge of third-party risk management, strong stakeholder engagement, and the ability to translate complex cyber risks into clear business insights for senior leadership.

Qualifications

• Deep understanding of Cyber Third Party Risk Management including supplier risk assessments and continuous monitoring.
• Experience leading and refining a Third Party Cyber Risk function and operating model.
• Strong ability to translate cyber risk into actionable business insights for senior stakeholders.

Responsibilities

• Act as the FCA’s cyber lead for Third Party Risk Management, setting strategy and reporting to the CISO/CIO.
• Lead the third-party cyber risk team in delivering the cyber assurance approach across onboarding, monitoring, assessments, escalation and reporting.
• Oversee emerging third-party risks, including Agentic AI adoption and exposure management, ensuring risks are identified and managed.
• Embed cyber risk within supplier management and risk frameworks, aligning with regulatory regimes.
• Act as the cyber lead for third-party incidents, providing risk assessment and guidance for engagement and decision-making.
• Drive continuous improvement of third-party cyber risk capabilities through process and tooling enhancements.
• Manage external assessment providers and ensure quality, contract and sub-processor oversight.
• Translate complex cyber risks into clear business insights for management and committees.

Skills

Third party risk management

Strategic leadership

Stakeholder management

Risk-based decision making

Regulatory familiarity

Leadership of security professionals

Metrics and KPIs

Job description

Job title: Third Party Cyber Risk Lead Division: Operations Department: Cyber & Information Resilience (C&IR) - Cyber Assurance Salary: National (Edinburgh and Leeds) ranging from £60,700 to £75,600 and London from £66,600 to £83,000 (salary offered will be based on skills and experience).

This role is graded as: Lead Associate - Regulatory

About the FCA and team We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth and shaping the future of UK finance services.

We are recruiting for a Third Party Cyber Risk Lead to join the Cyber Assurance team within the Cyber & Information Resilience (C&IR) department. C&IR is responsible for enabling secure regulation at the FCA and PSR. This role leads the FCA’s third-party cyber risk capability, with responsibility for shaping and delivering the cyber assurance approach for the FCA’s supplier landscape. The role provides strategic and operational leadership across continuous monitoring, targeted cyber assessments, risk escalation and stakeholder engagement to ensure cyber risk arising from third parties is identified, assessed and managed effectively. It also drives continuous improvement in third-party cyber risk processes, tooling and reporting, working closely with internal partners such as Procurement, Supplier Management and Incident Management, as well as key external providers and industry stakeholders.

Role responsibilities

• Act as the FCA’s cyber lead for Third Party Risk Management, setting strategy, providing assurance, risk insights and senior reporting to stakeholders including the CISO and CIO
• Lead the third-party cyber risk team in delivering the FCA’s cyber assurance approach across supplier onboarding, continuous monitoring, risk-based assessments, escalation, reporting and AI-enabled risk management
• Oversee emerging third-party risks, including Agentic AI adoption and exposure management, ensuring risks are identified, assessed and managed before they become systemic
• Embed cyber risk within the FCA’s supplier management and third-party risk frameworks, influencing stakeholders and aligning with the FCA, PRA and Bank of England Critical Third Party oversight regime
• Act as the cyber lead for third-party incidents, providing risk assessment, technical advice and support for supplier engagement, incident response and senior decision-making
• Drive continuous improvement of third-party cyber risk capabilities through process optimisation, tooling, horizon scanning, enhanced management information and assurance effectiveness
• Manage external assessment providers and cyber assurance partners, ensuring effective delivery, assessment quality, contract management and sub-processor and fourth-party oversight
• Translate complex cyber risks into clear business insight through reporting, metrics, KPIs and KRIs, enabling informed decision-making at management and committee level
• Build effective internal and external relationships, promoting a collaborative risk-based assurance model and representing the FCA across regulatory bodies, specialist networks and third-party cyber audit activities

Skills required Minimum

• Deep understanding of Cyber Third Party Risk Management, including supplier risk assessments, continuous monitoring, cyber assurance, risk-based decision-making and the application of frameworks such as NIST CSF 2.0
• Deep understanding of third-party cyber risk technologies, including analytical and AI-enabled tools that enhance monitoring, assessment quality and operational effectiveness
• Ability to translate complex cyber risks into clear, practical insights and recommendations for both technical and senior business stakeholders

Skills required Essential

• Experience establishing and refining a Third Party Cyber Risk function, covering supplier risk assessments, ongoing monitoring, operating model development, and organizational capability building
• Effective stakeholder management and influencing skills, with experience challenging and guiding technical and business teams, implementing risk mitigation strategies and managing escalations across all levels of an organisation
• Broad understanding of supplier and supply chain risk management, including the interaction between cyber risk, procurement, supplier management, operational resilience, incident management and enterprise risk frameworks
• Experience leading and developing security professionals, including line management and technical coaching
• Experience producing meaningful cyber metrics, KPIs and KRIs to support risk oversight, reporting and senior decision-making
• Solid awareness of the external cyber risk landscape, including emerging threats, regulatory developments, industry expectations and best practices relating to supplier security and resilience

Benefits

• 25 days annual leave plus bank holidays
• Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
• Private healthcare with Bupa, income protection and 24/7 Employee Assistance
• 35 hours of paid volunteering annually
• Colleagues spend a minimum of 50% of their working time in the office each month (60% for Directors and Executive Directors) across our London, Leeds and Edinburgh offices.
• A flexible benefits scheme designed around your lifestyle

For a full list of our benefits and our recruitment process as a whole visit our benefits page.

Our values and culture

Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference and supports colleagues to deliver at their best. We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation and delivers better regulation.

If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support.

We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part-time and job sharing where applicable.

Disability confident: our hiring approach

We’re proud to be a Disability Confident Employer and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process.

In cases of high application volumes we may progress applicants whose experience most closely matches the role’s key requirements.

Useful information and timelines

Timeline: Job advert closes: 11:59pm, 25th October 2026 CV Review/Shortlist: 27th October 2026 Interview: w/c 2nd November 2026 SC Clearance is required for this role (SC Guidance) - you will hold or will be required to obtain Security Check (SC) level vetting Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.

At the FCA, we’re creating a fair and more resilient financial system. We’re establishing more transparent relationships between financial services and their customers, building trust in financial markets and protecting vulnerable consumers.

Click here to learn more about the FCA.