Job Description

Third Party Risk Management (TPRM)

Location: UK / Hybrid
Sector Coverage: Banking, Insurance, Asset & Wealth Management, Financial Market Infrastructure, Regulatory Bodies

About the Role

We are seeking an exceptional Third Party Risk Management (TPRM) leader to join our Financial Services practice.

This role is suited to an individual who combines deep industry expertise with consulting experience and has helped major financial institutions navigate increasingly complex third-party ecosystems. You will be recognised as a trusted advisor to executives, boards and regulators, with a proven track record of designing, transforming and operating leading TPRM, outsourcing and operational resilience capabilities.

You will bring experience gained within banks, insurers, asset managers or regulators, complemented by a consulting background that enables you to solve complex challenges, lead large-scale transformations and shape strategic thinking across organisations.

As a senior leader, you will help clients address the challenges posed by cloud adoption, AI, critical third parties, operational resilience, concentration risk, emerging regulation and increasingly interconnected supply chains.

Key Responsibilities

TPRM Strategy and Transformation

• Lead the design and transformation of enterprise-wide TPRM frameworks, operating models and governance structures.
• Advise Boards and Executive Committees on third-party, outsourcing and supplier-related risks.
• Develop target operating models that align procurement, risk, resilience, compliance, legal and technology functions.
• Lead large-scale TPRM transformation, remediation and regulatory change programmes.
• Define risk appetites, control frameworks, policies, standards and key risk indicators.

Regulatory and Supervisory Expertise

• Advise clients on current and emerging regulatory requirements, including:
  • PRA SS2/21
  • FCA Operational Resilience
  • DORA
  • EBA Outsourcing Guidelines
  • Basel operational risk expectations
  • Solvency II outsourcing requirements
  • Critical Third Party (CTP) regulation
• Lead regulatory readiness assessments, remediation programmes and assurance reviews.
• Support interactions with regulators, internal audit and external assurance providers.
• Translate complex regulatory requirements into practical and sustainable controls.

Operational Resilience and Outsourcing

• Assess third-party support of important business services and critical operations.
• Develop approaches to supplier resilience testing, substitution and exit planning.
• Lead scenario testing involving critical suppliers and outsourced service providers.
• Advise on resilience considerations associated with cloud services, technology providers and shared industry infrastructure.

AI, Technology and Digital Supplier Risk

• Design governance and risk management frameworks for AI-enabled suppliers and service providers.
• Conduct due diligence assessments of AI, Generative AI and machine learning vendors.
• Evaluate risks associated with:
  • AI governance and accountability
  • Model transparency and explainability
  • Bias and fairness
  • Data privacy and sovereignty
  • Intellectual property exposure
  • Model drift and emerging AI threats
• Advise on management of hyperscaler, SaaS, PaaS and IaaS provider risk.

Executive Leadership and Client Development

• Build trusted relationships with CROs, COOs, CIOs, CISOs, Heads of Procurement and regulators.
• Lead multi-disciplinary teams across complex engagements.
• Develop thought leadership and market propositions.
• Contribute to business development, account growth and go-to-market activities.
• Mentor and develop future TPRM leaders.

Technical Expertise Required

The successful candidate should demonstrate extensive expertise across the end-to-end supplier lifecycle.

Third Party Risk Management Frameworks

• TPRM policy, standards and governance design.
• Risk appetite and control framework development.
• Supplier segmentation and criticality assessment methodologies.
• Risk-based tiering and monitoring approaches.
• Board and Executive-level reporting.

Third Party Registers and Inventory Management

• Design and implementation of:
  • Outsourcing registers
  • Third-party inventories
  • Service registers
  • Supplier ownership models
• Development of data models linking suppliers, contracts, services, business processes and risks.
• Establishment of data governance and control frameworks across supplier ecosystems.

Due Diligence and Risk Assessment

Extensive experience designing and executing due diligence frameworks covering:

• Financial stability and viability
• Operational resilience
• Cyber security
• Information security
• Data privacy and protection
• Business continuity and disaster recovery
• ESG and sustainability
• Regulatory compliance
• Geographic and geopolitical risk
• Financial crime
• AI and model risk
• Fourth-party and nth-party dependencies

Critical Third Parties and Concentration Risk

• Assessment of systemic and sector-wide supplier risks.
• Development of concentration risk frameworks.
• Analysis of cross-industry dependencies.
• Experience assessing:
  • Cloud providers
  • Payment infrastructures
  • Technology platforms
  • Market utilities
  • Industry shared services
• Development of CTP impact assessments and risk mitigation strategies.

Fourth-Party and Supply Chain Risk

• Supply chain mapping and dependency analysis.
• Subcontractor oversight frameworks.
• Fourth-party visibility and assurance programmes.
• Ecosystem risk modelling and monitoring.

Operational Resilience

• Important Business Service mapping.
• Impact tolerance assessments.
• Third-party resilience testing.
• Exit and substitution planning.
• Recovery and continuity capability assessments.
• Scenario and stress testing.

TPRM Data, Analytics and Technology

Experience with leading platforms including:

• ServiceNow
• Archer
• MetricStream
• ProcessUnity
• OneTrust
• Coupa
• SAP Ariba
• Fusion Risk Management

Alongside experience of:

• Workflow automation.
• Control monitoring.
• Supplier risk analytics.
• Continuous monitoring solutions.

AI-enabled risk assessment and monitoring tools.

Qualifications

Experience Required

Essential

• 8-12+ years of experience in Third Party Risk Management, Operational Resilience.
• Experience gained across from industry and/or consulting environments.
• Demonstrable expertise within banking, insurance, asset management or financial regulation.
• Proven experience leading enterprise-wide TPRM transformations.
• Strong understanding of technology, cloud and digital supplier risk.
• Experience engaging directly with regulators, executive committees and boards.
• Strong commercial and client-facing capabilities.

Highly Desirable

• Experience working for a financial regulator or supporting regulatory supervision activities.
• Experience leading responses to regulatory findings, reviews or remediation programmes.
• Experience with AI governance and AI supplier risk management.
• Experience establishing operational resilience capabilities involving critical third parties.
• Thought leadership credentials within TPRM, outsourcing or operational resilience.

We know the skill-gap and ‘somewhat need to tick every box’ can get in the way of meeting brilliant candidates, so please don’t hesitate to apply – we’d love to hear from you.

Apply today by completing our online application

Please be aware that some of our UK roles at PA Consulting require a UK security clearance.

All PA people are required to undergo background checks and to achieve the Baseline Personnel Security Standard however, some UK roles also require higher levels of National Security Vetting, where applicants must have at least 5 years of continuous residency in the UK.

We therefore ask that you only apply if you meet the residency requirements (i.e. you are a British citizen or have been resident in the UK for the past 5 years), as this is the prerequisite for a security clearance. If you're unsure about your eligibility, we encourage you to review the UK Government’s guidance on security vetting before applying.

Additional Information

Life At PA encompasses our peoples' experience at PA. It's about how we enrich peoples’ working lives by giving them access to unique people and growth opportunities and purpose led meaningful work.

Our purpose guides how we work with our clients and our teams, and support our communities, to deliver insight and impact, solving the world’s most complex challenges. We're focused on building a workplace that values human difference and diverse mindsets, and a culture of inclusion and equality that unlocks the potential in our people so everyone can be their best self.

Find out more about Life at PA here.

We are dedicated to supporting the physical, emotional, social and financial well-being of our people. Check out some of our extensive benefits:

• Health and lifestyle perks accompanying private healthcare
• 25 days annual leave (plus a bonus half day on Christmas Eve) with the opportunity to buy 5 additional days
• Generous company pension scheme
• Opportunity to get involved with community and charity-based initiatives
• Annual performance-based bonus
• PA share ownership
• Tax efficient benefits (cycle to work, give as you earn)

We’re committed to advancing equality. We recruit, retain, reward and develop our people based solely on their abilities and contributions and without reference to their age, background, disability, genetic information, parental or family status, religion or belief, race, ethnicity, nationality, sex, sexual orientation, gender identity (or expression), political belief, veteran status, or any other range of human difference brought about by identity and experience. We welcome applications from underrepresented groups.

Adjustments or accommodations - Should you need any adjustments or accommodations to the recruitment process, at either application or interview, please contact us.

#LI-MH1