Third Party Risk Management Analyst

G Mass; Greater London; Hybrid; GBP 55,000 - 75,000; Full time

Benefits offered by this job

Contract: 12 month contract

Hybrid working

Job summary

G MASS is partnering with a global financial market infrastructure provider to strengthen its third-party risk management function. This 12-month contract role is based in London, with hybrid working and potential permanent opportunities.

You will carry out risk assessments across the full vendor lifecycle, review evidence, and coordinate remediation actions with business owners and suppliers, feeding into risk committees and governance forums.

Qualifications

• 1-4+ years' hands-on experience conducting third-party or vendor risk assessments, ideally within financial services.
• Strong understanding of information security and operational resilience controls.
• Confidence reviewing and challenging vendor evidence, including questionnaires and SOC reports.
• Working knowledge of PRA SS2/21, FCA SYSC 8, DORA or the EBA Outsourcing Guidelines.
• Exceptional attention to detail and full ownership of the accuracy of your own work.
• Disciplined and process-driven, with the ability to manage high volumes against fixed deadlines.
• Proactive, with the initiative to drive work forward without close direction.
• Experience with ProcessUnity or a similar GRC platform is an advantage.
• Confident stakeholder management with business owners and external suppliers, and clear, concise written communication.

Responsibilities

• Carry out risk assessments of new and existing third parties across due diligence, onboarding, periodic review and exit, with a focus on technology suppliers.
• Review vendor evidence including questionnaires, SOC reports and policies, challenging responses and identifying control gaps.
• Agree remediation actions with business owners and suppliers, tracking them through to closure.
• Assign and maintain risk ratings and criticality tiering, keeping the third-party inventory and risk register accurate within ProcessUnity.
• Manage a high volume of assessments against deadlines tied to regulatory requirements.
• Support outsourcing classification and concentration risk analysis in line with regulatory requirements and internal policy.
• Produce accurate, well‑evidenced assessment output for review and onward reporting to risk committees and governance forums.
• Escalate material issues to senior stakeholders.
• Take initiative in improving the quality and consistency of the team’s work, supporting colleagues where needed.

Skills

Vendor risk assessments

Information security

Operational resilience

Stakeholder management

Regulatory awareness

Analytical thinking

Self-motivation

Communication

Tools

ProcessUnity

Job description

G MASS is partnering with a global financial market infrastructure provider to strengthen its third-party risk management function.

This is a client-side role within the firm’s third-party risk team. Analysts carry out the assessments themselves, with subject matter experts verifying the outcome, and their output feeds directly into the firm’s risk committees and governance forums.

The work covers the full vendor lifecycle, from due diligence and onboarding through periodic review and exit, with a particular emphasis on information security and operational resilience. Volumes are high and deadlines are tied to regulatory requirements, including PRA SS2/21, FCA SYSC 8, DORA and the EBA Guidelines on outsourcing arrangements. The function is also going through operational effectiveness testing, so accuracy and a strong risk mindset are essential.

The role suits a hands‑on third-party risk analyst, who is used to conducting assessments rather than coordinating them, and who is disciplined, detail-focused and confident challenging suppliers. This is an initial 12-month contract based in London, with a strong chance of being made permanent.

Key Responsibilities

• Carry out risk assessments of new and existing third parties across due diligence, onboarding, periodic review and exit, with a focus on technology suppliers.
• Review vendor evidence including questionnaires, SOC reports and policies, challenging responses and identifying control gaps.
• Agree remediation actions with business owners and suppliers, tracking them through to closure.
• Assign and maintain risk ratings and criticality tiering, keeping the third-party inventory and risk register accurate within ProcessUnity.
• Manage a high volume of assessments against deadlines tied to regulatory requirements.
• Support outsourcing classification and concentration risk analysis in line with regulatory requirements and internal policy.
• Produce accurate, well‑evidenced assessment output for review and onward reporting to risk committees and governance forums.
• Escalate material issues to senior stakeholders.
• Take initiative in improving the quality and consistency of the team’s work, supporting colleagues where needed.

Requirements

• 1-4+ years' hands-on experience conducting third-party or vendor risk assessments, ideally within financial services.
• Strong understanding of information security and operational resilience controls.
• Confidence reviewing and challenging vendor evidence, including questionnaires and SOC reports.
• Working knowledge of PRA SS2/21, FCA SYSC 8, DORA or the EBA Outsourcing Guidelines.
• Exceptional attention to detail and full ownership of the accuracy of your own work.
• Disciplined and process-driven, with the ability to manage high volumes against fixed deadlines.
• Proactive, with the initiative to drive work forward without close direction.
• Quick to learn new systems; experience with ProcessUnity or a similar GRC platform is an advantage.
• Confident stakeholder management with business owners and external suppliers, and clear, concise written communication.

Benefits

• Contract: 12 month contract, with a view to going permanent with the end client
• Hybrid working