Supplier Risk Lead

Overview

In this role you provide independent oversight of supplier risk within the Second Line of Defence for FCE Bank. You will focus on outsourcing risks across ICT, information security, and operational resilience, ensuring alignment with risk appetite and evolving regulatory expectations. You will design and enhance the TPRM framework, monitor KRIs, and support audits to strengthen defensible decision-making and overall resilience. You will partner with business units to shape risk culture, oversee incidents, and deliver training to uplift risk assessment quality.

Responsibilities

• Review and challenge supplier risk assessments and classifications conducted by the First Line
• Conduct QA of due diligence and risk mitigation plans
• Lead design and enhancement of the global Third-Party Risk Management framework and policy
• Maintain supplier risk classification tools and support GRC/TPRM system optimization
• Produce consolidated risk reporting and MI for senior leadership and Risk Committees
• Monitor KRIs, policy exceptions, and risk acceptances against appetite
• Oversee monitoring of third and fourth-party incidents with robust root-cause analysis
• Provide advisory support to contract managers and Vendor Management
• Develop and deliver training to strengthen risk culture and assessment quality
• Facilitate risk-profiling workshops for high-risk or complex supplier projects
• Ensure TPRM compliance with regulatory standards (DORA, PRA SS2/21, BCBS/BIS)
• Support internal audits and regulatory inspections, evidencing 2LoD oversight
• Maintain ICT Third-Party Register of Information under DORA
• Assess third and fourth-party concentration risk to safeguard operational resilience

Key requirements

• Relevant professional risk or security certifications (e.g., CRISC, CISA, or IRM)
• Experience in independent risk oversight of supplier risk and third-party relationships
• Strong knowledge of regulatory standards (DORA, PRA/FCA) and risk management frameworks

• Stakeholder management
• Advisory mindset
• Training and development
• Third-Party Risk Management (TPRM) framework
• GRC systems
• Risk reporting and MI production

…