Define, lead and deliver the information security and third-party risk assessment programmes.
Delivery of the information security and third-party risk assessment programmes.
Ownership of the information security and third-party risk assessment frameworks.
Development and implementation of the information security and third-party risk assessment strategy.
Definition of information security and third-party risk assessment services, deliverables and SLAs.
Demand management and planning across information security and third party risk assessment services.
Ensure integration of risk assessments with related processes and services
information security and third-party risk assessment service measurement through SLAs, KRIs and KPIs.
Accountable for leading information security and third party teams to conduct threat and asset-based risk assessments that identify and assess risks and identify key security controls required to manage risk within appetite.
Establishment and delivery of a programme for periodic re-assessment of information security and third-party risks.
Alignment with all relevant internal policies, standards and frameworks
Population of Group Digital risk register.
5+ years’ experience in information security and third-party risk assessments.
3+ years in a senior management role.
Risk definition including explanation of technical risks to non-technical audiences.
Strong working knowledge of infrastructure, application, service (including cloud) and application security and mitigating controls.
Senior stakeholder management.
In depth understanding of security, risk and data privacy standards such as ISO 31000, ISO 27001, ISO 27701, IRAM, CIS, SOC 2, GDPR, ISO 27701, etc.
From live job posts on CoreHRx, updated 29 Oct 2026. Skill figures count posts that list their skills; salary figures only posts that show a salary.
