Third-Party Security Assessor

You’ll join a small, senior team assessing supplier cyber security for a UK critical national infrastructure organisation. The team will clear a backlog, make assessments more consistent and better quality, and hand over a stronger process at the end. Your findings will directly shape how the organisation manages supplier risk.

• £50,000 to £60,000, up to £65,000 with current SC clearance, plus 3% employer pension
• 9-month fixed-term employment contract, full time, starting December 2026
• Remote (UK), with occasional paid travel to client sites in the Midlands, agreed in advance

• Assess suppliers’ cyber security, starting with critical and higher-risk suppliers, and write clear, evidence-based findings on control gaps
• Run assessments on a third-party risk management (TPRM) platform: questionnaires, supplier collaboration and status tracking
• Work directly with the client’s Supply Chain Security team and supplier contacts to escal…
• Peer-review colleagues’ assessments as part of quality assurance
• Help improve the client’s assessment framework, including questionnaires, risk ratings, processes and reporting
• Support evidence-based testing of selected critical suppliers’ controls

• At least 3 years of hands‑on supplier or third‑party security assessment experience
• A solid grounding in security controls: access management, vulnerability and patch management, incident response, business continuity, data protection and cloud security
• Working knowledge of ISO/IEC 27001, NIST CSF or the NCSC Cyber Assessment Framework
• Strong stakeholder skills, including firm, constructive conversations with suppliers, and clear written findings for readers who haven’t seen the evidence
• A relevant certification, such as CISSP, CISA, CISM, CRISC, CompTIA Security+ or ISO/IEC 27001 Lead Auditor
• Eligibility for UK Security Check (SC) clearance, and availability to start within 2 weeks of an offer

• Current SC clearance (please include the level, expiry date and sponsoring organisation)
• Experience in energy, utilities, other critical national infrastructure or financial services
• Hands‑on use of a TPRM platform
• Experience testing controls against evidence, not only reviewing questionnaire responses

• 20 days’ holiday plus bank holidays and a wellbeing day (pro rata), and sick pay
• Training and certification on the TPRM platform used for delivery
• Close work with experienced, certified practitioners
• A route to a permanent role if new work follows, which the business expects as it grows
• BPSS checks arranged and paid for