Provide second-line oversight of first‑line cyber controls, assessing their design, implementation and effectiveness.
Identify and report cyber risks, supporting formal risk processes (RCSAs, assurance actions) to ensure timely closure.
Plan and manage second-line red team programmes and where required support regulatory or auditor testing (e.g., CBEST/FCA/PRA) to drive resilience improvements.
Plan and deliver second-line scheduled and ad‑hoc assurance testing (penetration, red team, vulnerability sampling) to validate first line remediation and control effectiveness.
Challenge first-line to track and drive remediation of findings from testing, reviews and incidents, ensuring clear remediation plans and closure.
Analyse first-line cyber processes and technical incident responses to identify gaps, root causes and pragmatic remedial actions.
Oversee cyber risk mitigation projects and control improvement initiatives to reduce exposure and strengthen defences.
Communicate risk findings and recommendations clearly to stakeholders, enabling timely, informed decision‑making.
Requirements
Experience in financial services, consulting or technology roles in cyber security or technology risk (essential)