• 10/08/26
• London, City of London
• £80k - 90k per year
• Permanent
• Cyber Security and InfoSec
• Full time

Cyber Vendor Risk Lead

London | Hybrid (3 Days Onsite) | £90,000 per annum

Are you an experienced Cyber Security professional with a background in vendor risk, third-party assurance and regulatory compliance?

This is an opportunity to take ownership of a growing Cyber Vendor Risk function within a highly regulated international organisation. Working within the Information Security team, you will drive the maturity of the third-party cyber risk programme, helping the business identify, assess and manage cyber risks across a complex global supplier landscape.

You'll work closely with Procurement, Legal, Technology and Risk teams, influencing stakeholders at all levels and ensuring robust cyber security controls are embedded throughout the supplier lifecycle.

About the Organisation

A well-established global organisation operating within a highly regulated environment. Technology, security and operational resilience are central to its continued success, creating an environment where talented professionals can make a real impact while helping shape the future of cyber risk management.

Why Join?

• Own and shape a strategically important cyber security programme.
• Influence senior stakeholders across technology and business functions.
• Work within a complex, highly regulated environment.
• Play a key role in strengthening cyber resilience across a global supplier ecosystem.
• Join a collaborative organisation that values innovation, continuous improvement and professional development.

Key Responsibilities

• Own and continuously improve the cyber vendor risk management framework and processes.
• Lead third-party security due diligence activities across onboarding, renewals and ongoing monitoring.
• Establish and maintain vendor criticality assessments, ensuring risk-based assurance activities are applied consistently.
• Provide expert guidance on supplier security assessments, contract reviews and remediation activities.
• Build meaningful reporting, dashboards and management information for senior stakeholders and executive audiences.
• Collaborate with Procurement, Legal and Technology teams to embed cyber risk controls throughout the supplier lifecycle.
• Ensure compliance with relevant regulatory and industry requirements, including DORA, NIS2, GDPR, ISO 27001 and NIST-aligned controls.
• Identify, assess and escalate significant supplier-related cyber risks and security concerns.
• Drive continuous improvement initiatives to enhance the maturity of vendor risk management capabilities.

Requirements

• Proven experience within Cyber Security, Information Security or Technology Risk.
• Strong expertise in cyber vendor risk, third-party risk management or supplier security assurance.
• Experience designing, implementing and improving security due diligence programmes.
• Strong understanding of vendor security assessments, including ISO 27001, SOC 2, CSA STAR and supplier assurance methodologies.
• Experience operating within highly regulated environments.
• Excellent stakeholder management and communication skills.
• Ability to translate technical cyber risks into clear business-focused recommendations.

Desirable Experience

• CISSP, CISM, CRISC, ISO 27001 Lead Implementer or equivalent certifications.
• Experience with GRC platforms and third-party risk management tools.
• Advanced reporting and dashboarding capabilities using Power BI or similar platforms.
• Experience supporting regulatory compliance and operational resilience initiatives.

Key Details

• Location: London
• Working Pattern: Hybrid (3 days onsite)
• Salary: £90,000 per annum.
• Type: Permanent

We welcome applicants from all backgrounds. Our Client are an equal opportunities employer. Xpertise is acting as an employment agency & business.

At Xpertise, we keep things human, your application will always be reviewed by a real person.

We do not rely on AI or automated screening tools. Every candidate receives fair, considered attention from our team.

Right to work in the UK is required for this role.