Supplier Risk Lead

Operating within the Second Line of Defence, the Supplier Risk Lead provides independent oversight, challenge, and assurance over FCE Bank's third-party and supplier risk profile, ensuring outsourcing risks - particularly ICT, information security, and operational resilience - are effectively managed by the business in line with risk appetite and evolving regulatory requirements (including DORA and PRA/FCA expectations), thereby supporting defensible decision-making, customer protection, and the bank's overall resilience.

Professional

Qualifications:

Relevant professional risk or security certifications (e.g., CRISC, CISA, or IRM credentials).Additional Information The Company is committed to diversity and equality of opportunity for all and is opposed to any form of less favourable treatment or harassment on the grounds of race, religion or belief, sex, marriage and civil partnership, pregnancy and maternity, age, sexual orientation, gender reassignment or disability. As part of our pre-employment checks process, successful candidates will be required to undergo a criminal record check.

This will be conducted in line with the Rehabilitation of Offenders Act 1974 and applied only to unspent convictions. This position is based in Dunton, Essex and it is expected the successful candidate will be able to attend the Dunton Campus for typically 4 days a week and remain flexible on the days they are required to attend the office according to business requirements.

#LI-AC5 #LI-Ford Credit #LI-Hybrid Independently review and challenge supplier risk assessments and classifications completed by the First Line Conduct quality assurance reviews on supplier due diligence and risk mitigation plans

Lead the design and enhancement of the global Third-Party Risk Management (TPRM) framework and policy

Maintain supplier risk classification tools and support optimisation of the GRC/TPRM system

Produce consolidated risk reporting, dashboards, and MI for senior leadership and Risk Committees Monitor Key Risk Indicators (KRIs), policy exceptions, and risk acceptances against risk appetite

Oversee monitoring of third and fourth-party incidents, ensuring robust root-cause analysis and remediation

Provide advisory support and guidance to business owners, contract managers, and Vendor Management Develop and deliver training to strengthen risk culture and assessment quality

Facilitate risk-profiling workshops for high-risk or complex supplier projects

Ensure TPRM compliance with regulatory standards (e.g., DORA, PRA SS2/21, BCBS/BIS)
Support internal audits and regulatory inspections, evidencing 2

LoD oversight

Maintain the ICT Third-Party Register of Information under DORA Assess third and fourth-party concentration risk to safeguard operational resilience

Full time Posting Date: