Third Party Risk Management (TPRM) Principal Consultant

Third Party Risk Management (TPRM)

Location: UK / Hybrid
Sector Coverage: Banking Insurance Asset & Wealth Management Financial Market Infrastructure Regulatory Bodies

About the Role

We are seeking an exceptional Third Party Risk Management (TPRM) leader to join our Financial Services practice.

This role is suited to an individual who combines deep industry expertise with consulting experience and has helped major financial institutions navigate increasingly complex third-party ecosystems. You will be recognised as a trusted advisor to executives boards and regulators with a proven track record of designing transforming and operating leading TPRM outsourcing and operational resilience capabilities.

You will bring experience gained within banks insurers asset managers or regulators complemented by a consulting background that enables you to solve complex challenges lead large-scale transformations and shape strategic thinking across organisations.

As a senior leader you will help clients address the challenges posed by cloud adoption AI critical third parties operational resilience concentration risk emerging regulation and increasingly interconnected supply chains.

Key Responsibilities

TPRM Strategy and Transformation

• Lead the design and transformation of enterprise-wide TPRM frameworks operating models and governance structures.
• Advise Boards and Executive Committees on third-party outsourcing and supplier-related risks.
• Develop target operating models that align procurement risk resilience compliance legal and technology functions.
• Lead large-scale TPRM transformation remediation and regulatory change programmes.
• Define risk appetites control frameworks policies standards and key risk indicators.

Regulatory and Supervisory Expertise

• Advise clients on current and emerging regulatory requirements including:
  • PRA SS2/21
  • FCA Operational Resilience
  • DORA
  • EBA Outsourcing Guidelines
  • Basel operational risk expectations
  • Solvency II outsourcing requirements
  • Critical Third Party (CTP) regulation
• Lead regulatory readiness assessments remediation programmes and assurance reviews.
• Support interactions with regulators internal audit and external assurance providers.
• Translate complex regulatory requirements into practical and sustainable controls.

Operational Resilience and Outsourcing

• Assess third-party support of important business services and critical operations.
• Develop approaches to supplier resilience testing substitution and exit planning.
• Lead scenario testing involving critical suppliers and outsourced service providers.
• Advise on resilience considerations associated with cloud services technology providers and shared industry infrastructure.

AI Technology and Digital Supplier Risk

• Design governance and risk management frameworks for AI-enabled suppliers and service providers.
• Conduct due diligence assessments of AI Generative AI and machine learning vendors.
• Evaluate risks associated with:
  • AI governance and accountability
  • Model transparency and explainability
  • Bias and fairness
  • Data privacy and sovereignty
  • Intellectual property exposure
  • Model drift and emerging AI threats
• Advise on management of hyperscaler SaaS PaaS and IaaS provider risk.

Executive Leadership and Client Development

• Build trusted relationships with CROs COOs CIOs CISOs Heads of Procurement and regulators.
• Lead multi-disciplinary teams across complex engagements.
• Develop thought leadership and market propositions.
• Contribute to business development account growth and go-to-market activities.
• Mentor and develop future TPRM leaders.

Technical Expertise Required

The successful candidate should demonstrate extensive expertise across the end-to-end supplier lifecycle.

Third Party Risk Management Frameworks

• TPRM policy standards and governance design.
• Risk appetite and control framework development.
• Supplier segmentation and criticality assessment methodologies.
• Risk-based tiering and monitoring approaches.
• Board and Executive-level reporting.

Third Party Registers and Inventory Management

• Design and implementation of:
  • Outsourcing registers
  • Third-party inventories
  • Service registers
  • Supplier ownership models
• Development of data models linking suppliers contracts services business processes and risks.
• Establishment of data governance and control frameworks across supplier ecosystems.

Due Diligence and Risk Assessment

Extensive experience designing and executing due diligence frameworks covering:

• Financial stability and viability
• Operational resilience
• Cyber security
• Information security
• Data privacy and protection
• Business continuity and disaster recovery
• ESG and sustainability
• Regulatory compliance
• Geographic and geopolitical risk
• Financial crime
• AI and model risk
• Fourth-party and nth-party dependencies

Critical Third Parties and Concentration Risk

• Assessment of systemic and sector-wide supplier risks.
• Development of concentration risk frameworks.
• Analysis of cross-industry dependencies.
• Experience assessing:
  • Cloud providers
  • Payment infrastructures
  • Technology platforms
  • Market utilities
  • Industry shared services
• Development of CTP impact assessments and risk mitigation strategies.

Fourth-Party and Supply Chain Risk

• Supply chain mapping and dependency analysis.
• Subcontractor oversight frameworks.
• Fourth-party visibility and assurance programmes.
• Ecosystem risk modelling and monitoring.

Operational Resilience

• Important Business Service mapping.
• Impact tolerance assessments.
• Third-party resilience testing.
• Exit and substitution planning.
• Recovery and continuity capability assessments.
• Scenario and stress testing.

TPRM Data Analytics and Technology

Experience with leading platforms including:

• ServiceNow
• Archer
• MetricStream
• ProcessUnity
• OneTrust
• Coupa
• SAP Ariba
• Fusion Risk Management

Alongside experience of:

• Workflow automation.
• Control monitoring.
• Supplier risk analytics.
• Continuous monitoring solutions.

AI-enabled risk assessment and monitoring tools.

Qualifications :

Experience Required

Essential

• 8-12 years of experience in Third Party Risk Management Operational Resilience.
• Experience gained across from industry and/or consulting environments.
• Demonstrable expertise within banking insurance asset management or financial regulation.
• Proven experience leading enterprise-wide TPRM transformations.
• Strong understanding of technology cloud and digital supplier risk.
• Experience engaging directly with regulators executive committees and boards.
• Strong commercial and client-facing capabilities.

Highly Desirable

• Experience working for a financial regulator or supporting regulatory supervision activities.
• Experience leading responses to regulatory findings reviews or remediation programmes.
• Experience with AI governance and AI supplier risk management.
• Experience establishing operational resilience capabilities involving critical third parties.
• Thought leadership credentials within TPRM outsourcing or operational resilience.

We know the skill-gap and somewhat need to tick every box can get in the way of meeting brilliant candidates so please dont hesitate to apply wed love to hear from you.

Apply today by completing our online application

Please be aware that some of our UK roles at PA Consulting require a UK security clearance.

All PA people are required to undergo background checks and to achieve the Baseline Personnel Security Standard however some UK roles also require higher levels of National Security Vetting where applicants must have at least 5 years of continuous residency in the UK.

We therefore ask that you only apply if you meet the residency requirements (i.e. you are a British citizen or have been resident in the UK for the past 5 years) as this is the prerequisite for a security clearance. If youre unsure about your eligibility we encourage you to review the UK Governments guidance on security vetting before applying.

Additional Information :

Life At PA encompasses our peoples experience at PA. Its about how we enrich peoples working lives by giving them access to unique people and growth opportunities and purpose led meaningful work. 

Our purpose guides how we work with our clients and our teams and support our communities to deliver insight and impact solving the worlds most complex challenges. Were focused on building a workplace that values human difference and diverse mindsets and a culture of inclusion and equality that unlocks the potential in our people so everyone can be their best self. 

Find out more about Life at PA here. 

We are dedicated to supporting the physical emotional social and financial well-being of our people. Check out some of our extensive benefits: 

• Health and lifestyle perks accompanying private healthcare
• 25 days annual leave (plus a bonus half day on Christmas Eve) with the opportunity to buy 5 additional days 
• Generous company pension scheme 
• Opportunity to get involved with community and charity-based initiatives 
• Annual performance-based bonus 
• PA share ownership 
• Tax efficient benefits (cycle to work give as you earn) 

Were committed to advancing equality. We recruit retain reward and develop our people based solely on their abilities and contributions and without reference to their age background disability genetic information parental or family status religion or belief race ethnicity nationality sex sexual orientation gender identity (or expression) political belief veteran status or any other range of human difference brought about by identity and experience. We welcome applications from underrepresented groups. 

Adjustments or accommodations - Should you need any adjustments or accommodations to the recruitment process at either application or interview please contact us.

#LI-MH1

Remote Work :

No

Employment Type :

Full-time