Third Party Risk Management Lead

Overview

In this role you manage the first-line risk lifecycle for outsourcing and ICT third parties, shaping governance and controls to protect critical trading services. You will implement DORA and FCA/PS26/2 requirements across a cross-functional team, driving operational resilience and regulatory reporting. The position combines hands-on risk assessment with strategic program leadership to automate due diligence and evidence gathering. You will work closely with Technology, Operations, Legal, Procurement, and Compliance to enable scalable, compliant third-party management and continuous improvement.

Responsibilities

• Own third-party and ICT third-party inventories, including DORA and FCA registers, ensuring accurate classification of services
• Map third parties to business services, processes, assets, and controls with impact tolerances (RTO/RPO)
• Document exit strategies and substantiability analyses for ICT services
• Lead first-line risk assessment, due diligence, and contracting for outsourcing and ICT services
• Guide onboarding, risk assessment, contract review, and approvals with business owners
• Conduct risk-based due diligence across information security, resilience, data protection, financial crime, and concentration risk
• Embed DORA Article 30 contractual requirements with Legal and Procurement
• Coordinate resiliency testing with Operational Resilience SMEs and include third parties where applicable
• Support execution of DORA Chapter V ICT third party risk and FCA/PS26/2/FG26/4 implementations
• Drive ongoing monitoring, regulatory reporting, and management reporting to senior stakeholders
• Maintain records and track remediation actions for due diligence findings and audit actions
• Collaborate with Technology, Operations, and Procurement to embed controls and testing
• Represent Third Party Management in discussions with Compliance and Operational Risk
• Prepare regulatory returns and notifications (DORA, FCA registers)
• Oversee incident reporting involving third parties for UK/EU entities
• Act as a partner to Operations, Technology, and Procurement to enable risk-informed decisions

Key requirements

• Minimum five years in outsourcing/third-party risk management, technology risk, or operational resilience in financial services
• Knowledge of DORA Chapter V ICT third-party risk, EBA Outsourcing Guidelines, and FCA/PRA expectations
• Experience with due diligence and monitoring for material third parties and ICT services
• Experience leveraging AI-driven tooling to enhance due diligence, evidence review, data handling, and records maintenance
• Strong written and verbal communication with ability to discuss risk with engineers, product owners, and vendors
• Excellent stakeholder management and organizational skills
• Pragmatic, risk-based mindset with ability to manage a large portfolio of third parties

• Strong stakeholder management
• Effective communication with technical and non-technical audiences
• Problem-solving and critical thinking
• DORA Chapter V ICT third party risk
• EBA Guidelines on Outsourcing Arrangements
• FCA and PRA outsourcing and third party expectations

…