Third Party Risk Manager
The role of a Third Party Risk Manager sits at the intersection of technology, risk management, and procurement.
The key responsibilities include:
* Implementing management controls to ensure critical suppliers deliver services in a secure and resilient manner within organisational risk appetite, as well as in line with contractual and regulatory requirements.
* Leading third-party risk assessment processes with a focus on information security, data protection, and operational resilience.
* Ensuring timely identification, documentation, and mitigation/escalation of third-party related risks.
* Partnering with procurement, internal security management, IT/OT, DPO, and Legal teams to complete supplier due diligence and associated control non-conformity remediations.
* Leading technology tender processes from specification to evaluation and selection, collaborating with technology, procurement, and legal teams.
* Facilitating ongoing supervision of critical suppliers in line with contractual and security requirements.
* Implementing and managing the governance framework in support of the effective management of key technology suppliers, including SLAs, KPIs, compliance, and contract adherence.
* Ensuring ongoing monitoring and reviews of supplier performance, risk exposure, and compliance with policies and regulations (e.g., ISO 27001, GDPR, NIS2).
* Escalating supplier non-performance issues in line with internal policy.
* Completing management reporting on vendor compliance levels to facilitate management risk oversight.
* Contributing to the selection, implementation, and operation of third-party risk management tools.
* Driving continuous improvement of supplier onboarding, contract review, risk assessment processes, and management reporting.
The ideal candidate will possess the following qualifications, skills, knowledge, and attributes:
* Proven experience in supplier management, ideally with a technology or security-focused role.
* Understanding of third-party risk, especially in the information security domain.
* Familiarity with key regulatory and industry standards (e.g., ISO 27001, GDPR, NIS2).
* Strong relationship-building and stakeholder management skills, both internally and externally.
* Experience working in cross-functional teams and managing external supplier relationships.
* Excellent analytical, problem-solving, and negotiation skills.
* Proven management reporting experience.
* Desirable: Project management experience.
* Experience in energy, utilities, or critical infrastructure industries.
* Experience completing Data Protection Impact Assessment (DPIA) process.
* Familiarity with Personal Data Processing Agreement (DPA) requirements.
* Understanding of Operational Technology (OT) supplier-related risks.
* Conceptual understanding of cloud security and SaaS supplier-related risks.
As a Third Party Risk Manager, you will have the opportunity to work with a range of stakeholders, including procurement, internal security management, and legal teams. You will be responsible for implementing and managing the governance framework in support of the effective management of key technology suppliers.