Head of Third Party & Outsourcing Risk

At a glance

As an organization we outsource quite a lot of activities and work with many third parties. While this delivers opportunities and efficiencies, it also creates risks that need to be managed. Especially in this day and age where we are more and more digitally connected into a wider eco‑system. At ABN AMRO non‑financial risk management is performed according to the three lines of defence model.

The Head of Third Party & Outsourcing Risk is groupwide responsible for all second line of defence activities within the ABN AMRO group related to outsourcing and third party risks. As part of the wider IT & Cyber CRO function you lead the 2nd line activities for these risk types, providing independent and adequate oversight over first line activities in this space, as well as guiding and assisting the first line organization in mitigating the relevant risks that matter.

You are also pivotal in setting risk boundaries and managing risk expectations for this risk type to all relevant stakeholders, including management board and regulators.

You do this with independence, authority and the relevant knowledge and competencies. In doing so you will lead a small team of professionals. Furthermore you will be part of the management team of the CRO IT & Cyber function and you are expected to help develop this function as a whole to the next level. This is an expert lead role which requires a mixed skillset of team management, expert leadership and good stakeholder management and communication skills.

As such this role is a great opportunity to further develop your personal leadership.

Are you our new leader on outsourcing and third party risk management ? Do you recognize yourself in this profile and are you up for this challenge ? If so, please apply.

You are a seasoned and experienced non‑financial risk manager, with focus on and experience in third party risk, IT risk and cyber security risk. You are an effective communicator. You are able to maintain 2nd line of defence independence while balancing this with clear and open cooperation with relevant first line colleagues. You bring clarity and decisiveness to the table, and inspire trust and confidence in key stakeholders as well as into your team.

You are also able to switch between operational, tactical and strategic work and dialogue. Furthermore you have:

In depth knowledge of relevant:

• Laws and regulations, e.g. DORA, GDPR, NIS
  2.
• Supervisory directives, e.g. (Cloud) outsourcing guidelines.
• International standards, e.g. COBIT, NIST CSF, FAIR model.

Senior‑level experience with IT and vendor risk assessments and control design:

• Proven experience in conducting vendor, IT and cyber security risk assessments.
• Ability to identify, quantify, and prioritize risks at the enterprise level, including supply chain/third‑party risks.
• Designing, implementing and validating controls.

You are groupwide responsible for all second line of defence activities within the ABN AMRO group related to outsourcing and third party risks. In that capacity you will work closely with relevant first line functions such as Procurement, Contract Management, Information Security and Business Continuity functions. Your responsibilities include:

• Develop and maintain a Third Party & Outsourcing Risk policy and risk management framework.
• Set risk appetite for this risk type.
• Define key controls and control testing strategies regarding third Party & outsourcing risk.
• Identify, analyze and ensure alignment with new and changing regulatory and business objectives in this space.
• Define comprehensive guidelines and procedures to support consistent risk management practices across the organisation.
• Conduct qualitative and quantitative risk analysis for third party & outsourcings risk.
• Identify key concerns and help develop key mitigation strategies for those key concerns.
• Report relevant risk and manage all relevant stakeholders.

Key results and desired outcomes:

• Delivery of a strong 2nd LoD Risk Framework in this space.
• Effective contribution to our future sourcing strategies and vendor management practices.
• Development of scenarios and playbooks for key risk events.
• Being a proactive and…