Third Party Risk Management Analyst

G MASS is partnering with a global financial market infrastructure provider to strengthen its third-party risk management function.

This is a client-side role within the firm’s third-party risk team. Analysts carry out the assessments themselves, with subject matter experts verifying the outcome, and their output feeds directly into the firm’s risk committees and governance forums.

The work covers the full vendor lifecycle, from due diligence and onboarding through periodic review and exit, with a particular emphasis on information security and operational resilience. Volumes are high and deadlines are tied to regulatory requirements, including PRA SS2/21, FCA SYSC 8, DORA and the EBA Guidelines on outsourcing arrangements. The function is also going through operational effectiveness testing, so accuracy and a strong risk mindset are essential.

The role suits a hands-on third-party risk analyst, who is used to conducting assessments rather than coordinating them, and who is disciplined, detail-focused and confident challenging suppliers. This is an initial 12-month contract based in London, with a strong chance of being made permanent.

Key Responsibilities

• Carry out risk assessments of new and existing third parties across due diligence, onboarding, periodic review and exit, with a focus on technology suppliers.
• Review vendor evidence including questionnaires, SOC reports and policies, challenging responses and identifying control gaps.
• Agree remediation actions with business owners and suppliers, tracking them through to closure.
• Assign and maintain risk ratings and criticality tiering, keeping the third-party inventory and risk register accurate within ProcessUnity.
• Manage a high volume of assessments against deadlines tied to regulatory requirements.
• Support outsourcing classification and concentration risk analysis in line with regulatory requirements and internal policy.
• Produce accurate, well-evidenced assessment output for review and onward reporting to risk committees and governance forums.
• Escalate material issues to senior stakeholders.
• Take initiative in improving the quality and consistency of the team’s work, supporting colleagues where needed.

• 1-4+ years’ hands-on experience conducting third-party or vendor risk assessments, ideally within financial services.
• Strong understanding of information security and operational resilience controls.
• Confidence reviewing and challenging vendor evidence, including questionnaires and SOC reports.
• Working knowledge of PRA SS2/21, FCA SYSC 8, DORA or the EBA Outsourcing Guidelines.
• Exceptional attention to detail and full ownership of the accuracy of your own work.
• Disciplined and process-driven, with the ability to manage high volumes against fixed deadlines.
• Proactive, with the initiative to drive work forward without close direction.
• Quick to learn new systems; experience with ProcessUnity or a similar GRC platform is an advantage.
• Confident stakeholder management with business owners and external suppliers, and clear, concise written communication.

Contract: 12 month contract, with a view to going permanent with the end client

Hybrid working