Supplier Risk Lead

Description

Operating within FCE Bank’s Second Line of Defence, the Supplier Risk Lead provides independent oversight, challenge and assurance across the Bank’s third-party and supplier risk profile.

The role helps ensure that outsourcing arrangements, particularly those involving ICT, information security and operational resilience, are identified, assessed and managed by the First Line in accordance with the Bank’s risk appetite.

The Supplier Risk Lead will support the continued development of FCE Bank’s global Third-Party Risk Management (TPRM) framework, policies and practices. This includes maintaining alignment with evolving regulatory requirements, such as the Digital Operational Resilience Act (DORA), PRA SS2/21 and wider PRA and FCA expectations.

Through robust review, constructive challenge and clear risk reporting, the role supports informed decision-making, protects customer outcomes and strengthens the Bank’s operational resilience and regulatory compliance.

Location: Dunton Campus, Basildon, Essex
Working model: Four days per week onsite
Department: Risk
Function: ICT Risk Office, Second Line of Defence
Reports to: ICT Risk and Information Security Manager

• Independently review and challenge First Line supplier risk assessments, classifications and residual risk ratings.
• Conduct quality assurance reviews of supplier due diligence, controls and mitigation plans.
• Lead the development and ongoing enhancement of the global TPRM framework, policy and methodology.
• Maintain supplier risk classification tools, assessment templates and supporting GRC or TPRM workflows.
• Produce supplier risk reports, dashboards and management information for senior leadership and Risk Committees.
• Monitor Key Risk Indicators, policy exceptions, risk acceptances and remediation actions against risk appetite.
• Oversee material third-party and fourth-party incidents, including root-cause analysis and remediation.
• Advise business owners, contract managers and Vendor Management colleagues on supplier risk requirements.
• Deliver training and facilitate risk workshops for high-risk or complex supplier arrangements.
• Ensure the TPRM framework remains aligned with DORA, PRA SS2/21 and relevant regulatory expectations.
• Support internal audits and regulatory reviews by providing evidence of effective Second Line oversight.
• Oversee the DORA ICT Third-Party Register of Information.
• Assess third-party and fourth-party concentration risk to support operational resilience.

• Strong understanding of third-party risk management, outsourcing risk and operational risk principles.
• Working knowledge of outsourcing and operational resilience requirements, particularly DORA, PRA SS2/21 and wider PRA and FCA expectations.
• Good understanding of risks associated with outsourced ICT, information security, business continuity, disaster recovery and data protection.
• Ability to assess risk throughout the supplier lifecycle, including supplier financial viability, performance, controls and operational vulnerabilities.
• Strong analytical skills, with the ability to interpret qualitative and quantitative supplier risk information.
• Ability to identify trends, concentration risks and enterprise-wide vulnerabilities across a supplier portfolio.
• Confidence to provide independent and constructive challenge to First Line business owners while maintaining collaborative professional relationships.
• Excellent written and verbal communication skills.
• Ability to translate complex technical and regulatory risks into clear executive summaries, management information and risk reports.
• Strong problem-solving, organisational and prioritisation skills.
• Ability to manage multiple overlapping reviews and maintain accurate governance records.
• Self-motivated, disciplined and capable of working with an appropriate level of independence.

• At least three years of experience in operational risk, outsourcing risk or specialist Third-Party Risk Management.
• Experience working in a Second Line of Defence, independent risk oversight or assurance role.
• Experience with in a highly regulated organisation, preferably financial services operating under PRA and FCA…