Senior Third Party and Operational Resilience Manager

This senior role is responsible for the governance, performance, and risk management of the Banks’ external vendors and service providers. The role ensures that all third-party relationships align with regulatory requirements, business objectives, and risk management frameworks, while optimising costs and service quality. 

The incumbent will also maintain the stability of the Operational Resilience framework and support the Banks’ business continuity, so the bank can deliver Important Business Services in case of disruption, and meet its regulatory obligations.

They will set the strategy and standards for the full vendor lifecycle, challenge the first line, and report credibly to executive committees, the Board and regulators.

1. Key Responsibilities

3rd Party Management - Key Responsibilities & Accountabilities

• Own and continuously improve the third-party management framework, policy, standards and operating model across the full lifecycle including due diligence, contracting, onboarding, monitoring, performance, exit and termination.
• Manage and maintain a structured 3rd party management framework, ensuring compliance with internal policies and external regulations.
• Maintain the register of all third-party and outsourcing arrangements, including the materiality assessment and criticality ratings.
• Establish and monitor service level agreements (SLA’s) and key performance indicators (KPIs) to track vendor performance.
• Conduct due diligence and risk assessments for new and existing vendors, identifying and mitigating potential risks to the Bank and its services.
• Ensure adherence to regulatory and compliance standards, including Operational Resilience, Data Protection, cyber security, and Financial Viability.
• Collaborate with Legal, Risk, and Compliance teams to manage 3rd party contracts and obligations.
• Ensure contracts meet regulatory requirements, including audit and access rights, data location, incident notification, subcontracting controls and termination provisions.
• Ensure contracts are structured to support business requirements and minimise risk exposure.
• Adopt a continuous improvement approach to refine 3rd party management processes, incorporating best practices and industry standards commensurate with the size of the Bank.
• Develop reporting mechanisms to provide senior leadership (to Board level) with insights into vendor performance and risks.
• Leverage data analytics to inform decision-making and identify risks and trends in vendor management.
• Provide SME support in the overall management of vendors.
• Support the 3rd Party subordinate with the day-to-day running of the department and queries/requests that may arise.
• Test 3rd party exit planning for outsourced services in line with regulatory obligations.
• Plan and coordinate periodic audit requirements for 3rd party services.
• Provide support and guidance to business stakeholders with a focus on Critical and High-risk services.
• Act as a liaison to Group colleagues and peers for 3rd party matters. 
• Integrate resilience planning into business continuity, IT service management (ITSM), cyber security, and 3rd party management, including assisting with the preparation, maintenance, and reporting of the material 3rd party register to ensure compliance with the March 2027 regulatory requirement. 
• After March 2027, continue to monitor, update, and ensure the accuracy of the register and associated processes to maintain ongoing compliance.
• Ensure third-party dependencies are fully reflected in service mapping and resilience testing.

Operational Resilience / BCM - Key Responsibilities & Accountabilities

• Maintain the ongoing development of the existing Operational Resilience model and framework.
• Ensure Operational Resilience requirements are embedded into 3rd party framework. 
• Support business leaders in identifying Important Business Services and functions and assist with progress towards compliance where required.
• Assist in coordination across all areas of the Bank to help develop and document Operational Resilience and Business Continuity plans.
• Provide oversight of business continuity management, including business impact analyses, continuity plans, crisis management and recovery testing.
• Integrate business continuity, incident management and third-party failure scenarios into a single coherent resilience approach.
• Lead or support crisis response where a critical supplier fails or is disrupted.
• Facilitate and support resilience and business continuity testing, document outcomes, and share lessons learned from Operational Resilience and business continuity testing scenarios.
• Contribute to continuous improvement initiatives related to Operational Resilience by gathering feedback and identifying opportunities for enhancement.

1. Qualifications and Experience

1. Qualifications

• Bachelor’s degree in Business, Finance, Risk Management, or a related field (or equivalent experience)
• Experience in banking, financial services, or a regulated environment

1. Experience

• At least 5 years' proven experience in management of 3rd-party functions within financial services with line management responsibilities. 

1. Skills

• Proven experience in 3rd party/vendor management, procurement, or supplier governance within a regulated industry (e.g., finance or banking).
• Experience operating in a regulated environment 
• Experience with change activities.
• Good communication skills, both oral and written, including skills in presentations and ability to write documentation (PowerPoint & Word).
• Ability to adapt to evolving regulatory requirements and internal policies

1. Key Success Factors:

• Third party risk is well managed with good control over risk incidents and supplier issues.
• Demonstrable improvements to 3rd party and Operational Resilience frameworks and governance. 

1. Key Performance Indicators 

The postholder must deliver results in line with the following regulatory responsibilities, applying those relevant to the Banks’ jurisdictions and licences:

• Outsourcing & Third Party; PRA SS2/21 (Outsourcing and third party risk management); FCA SYSC 8 and SYSC 15A; EBA Guidelines on outsourcing arrangements where applicable.
• Operational resilience; PRA SS1/21 and FCA SYSC 15A: important business services, impact tolerances, mapping, scenario testing and self-assessment.
• Critical third parties; UK regime for critical third parties to the financial sector, including the Banks’ reliance on designated providers.
• EU operations; Digital Operational Resilience Act (DORA): ICT third-party risk, register of information, incident reporting and resilience testing.
• Business Continuity; Operational continuity in resolution expectations (PRA SS4/21) where applicable.

NOTE: Statements included in this Job Description are intended to reflect in general the duties and responsibilities of the position but are not to be interpreted as totally inclusive.