Supplier Risk Lead

Operating within the Second Line of Defence, the Supplier Risk Lead provides independent oversight, challenge, and assurance over FCE Bank's third-party and supplier risk profile, ensuring outsourcing risks - particularly ICT, information security, and operational resilience - are effectively managed by the business in line with risk appetite and evolving regulatory requirements (including DORA and PRA/FCA expectations), thereby supporting defensible decision-making, customer protection, and the bank's overall resilience.

Professional Qualifications: Relevant professional risk or security certifications (e.g., CRISC, CISA, or IRM credentials).Additional Information The Company is committed to diversity and equality of opportunity for all and is opposed to any form of less favourable treatment or harassment on the grounds of race, religion or belief, sex, marriage and civil partnership, pregnancy and maternity, age, sexual orientation, gender reassignment or disability. As part of our pre-employment checks process, successful candidates will be required to undergo a criminal record check. This will be conducted in line with the Rehabilitation of Offenders Act 1974 and applied only to unspent convictions. This position is based in Dunton, Essex and it is expected the successful candidate will be able to attend the Dunton Campus for typically 4 days a week and remain flexible on the days they are required to attend the office according to business requirements. #LI-AC5 #LI-FordCredit #LI-Hybrid

Independently review and challenge supplier risk assessments and classifications completed by the First LineConduct quality assurance reviews on supplier due diligence and risk mitigation plansLead the design and enhancement of the global Third-Party Risk Management (TPRM) framework and policyMaintain supplier risk classification tools and support optimisation of the GRC/TPRM systemProduce consolidated risk reporting, dashboards, and MI for senior leadership and Risk CommitteesMonitor Key Risk Indicators (KRIs), policy exceptions, and risk acceptances against risk appetiteOversee monitoring of third and fourth-party incidents, ensuring robust root-cause analysis and remediationProvide advisory support and guidance to business owners, contract managers, and Vendor ManagementDevelop and deliver training to strengthen risk culture and assessment qualityFacilitate risk-profiling workshops for high-risk or complex supplier projectsEnsure TPRM compliance with regulatory standards (e.g., DORA, PRA
SS2/21, BCBS/BIS)Support internal audits and regulatory inspections, evidencing 2LoD oversightMaintain the ICT Third-Party Register of Information under DORAAssess third and fourth-party concentration risk to safeguard operational resilience