Supplier Assurance Lead

Overview

In this role you take a lead in identifying and managing cyber security risks across a complex supplier ecosystem. You will work with procurement, commercial and security teams to embed risk-based decisions throughout the supplier lifecycle. Your work supports stronger third-party risk management and cyber resilience within a regulated, security-conscious environment. This position offers high-impact ownership and collaboration with cross-functional stakeholders to shape supplier security requirements and governance.

Responsibilities

• Lead cyber security assessments of prospective and existing suppliers using available information, supplier evidence, and assurance tooling
• Evaluate supplier security documents including penetration tests, certifications, audits, and SOC reports
• Own the supplier assurance process: tracking, reporting, governance, and metrics
• Provide risk-based advice on onboarding, contract renewals, and ongoing supplier engagements
• Ensure compliance with relevant regulatory and legislative requirements in supplier activities
• Maintain and mature supplier assurance processes in line with best practices and evolving threats
• Collaborate with procurement, legal, and operations to align supplier risk management
• Define cyber security requirements within supplier contracts and security docs
• Coordinate assessments involving both information and physical security controls where needed
• Advise on governance for handling sensitive or regulated information by suppliers
• Identify improvements to assurance processes, tooling, and reporting for third-party risk
• Review customer security requirements where the organisation acts as a supplier
• Act as the Cyber Security SME for supplier assurance and participate in stakeholder discussions
• Contribute to the ongoing development of third-party risk management frameworks and controls

Key requirements

• Significant experience in Information Security, Cyber Security GRC, Third-Party Risk Management or Supplier Assurance
• Proven track record in supplier assurance reviews and third-party cyber security assessments
• Experience reviewing supplier security evidence (penetration tests, certifications, audit findings, assurance docs)
• Strong understanding of supplier risk management and third-party cyber security risk
• Ability to assess technical security controls and communicate risks to technical and non-technical audiences
• Strong analytical and problem-solving abilities for complex technical information and business impact
• Experience with risk management frameworks, governance processes and assurance methodologies
• Excellent stakeholder management and relationship-building skills
• Strong written and verbal communication, with experience presenting risks to senior stakeholders
• Eligible for UK SC Security Clearance (active clearance preferred)

• Stakeholder management
• Clear communication
• Analytical thinking
• Information Security
• Cyber Security GRC
• Third-Party Risk Management

…