Business Analyst – Third Party Risk

We are seeking an experienced Cyber Security Third Party Risk Business Analyst to support a major third-party risk transformation programme, with a focus on defining and managing critical suppliers across the organisation.

This role will work closely with Procurement, Legal, Cyber Security, Risk, and business stakeholders to design frameworks, strengthen contractual controls, and embed consistent supplier risk practices.

• Develop a clear, evidence-based definition and framework for identifying and classifying critical suppliers.
• Design practical tools, guidance, and documentation to enable consistent application across business units.
• Facilitate workshops and stakeholder sessions to support supplier classification and consolidate outputs into an organisation-wide view.
• Review and enhance security contract addendums, strengthening cyber, regulatory, and risk-related clauses.
• Support broader third-party risk initiatives including process design, governance development, and operating model improvements.

• Strong Business Analysis experience, with the ability to translate complex requirements into structured outputs.
• Understanding of third-party risk, supplier risk, or criticality frameworks.
• Experience designing risk models, frameworks, or assessment criteria.
• Ability to analyse contract clauses, particularly security or risk-related content.
• Strong stakeholder engagement skills, with experience working across Legal, Procurement, Risk, or Cyber teams.
• Familiarity with regulations and frameworks such as GDPR, NIS2, DORA, ISO 27001, or ISO 27036 is advantageous.
• Analytical mindset with experience identifying gaps and driving process improvements.
• Comfortable operating in complex, federated environments.