Role Purpose 

The Third-Party Risk Specialist will have day-to-day ownership of the firm's third-party risk management framework, including supplier due diligence, risk assessments, stakeholder reviews, governance processes and ongoing supplier oversight. 

The role will act as the central point of coordination for supplier onboarding and oversight, ensuring that appropriate information is gathered, risks are assessed by relevant subject matter experts, approvals are obtained and records are maintained throughout the supplier lifecycle. 

The role will work closely with Risk & Compliance, Information Security, Data Protection, IT, Finance, Operations and business stakeholders to ensure third-party risks are identified, assessed and managed appropriately.  

Key Responsibilities 

Onboarding Process 

• Embedding and maintaining adherence to the supplier onboarding process across the business. 

• Driving continual improvement of the supplier onboarding process, including identifying opportunities to enhance efficiency, controls and user experience, and supporting the development of appropriate systems, workflows and reporting tools. 

• Identifying opportunities to streamline supplier onboarding and oversight processes through appropriate use of AI, automation and workflow optimisation. 

Supplier Due Diligence, Assessment and Approvals 

• Liaising with internal stakeholders and with suppliers, advising on onboarding requirements and documentation required  

• Sending out due diligence questionnaires using the firm’s third-party due diligence software 

• Maintaining and applying the firm’s supplier risk classification and due diligence methodology, ensuring that the scope and frequency of assessments are proportionate to supplier criticality, data access, system connectivity and wider risk exposure. 

• Conducting risk assessments with input from subject matter experts including Information Security and Data Protection. 

• Reviewing due diligence and contractual documentation, identifying risk areas, coordinating specialist review where required and supporting the implementation of  appropriate controls. 

• Tracking and recording the progress of supplier assessments and approvals. 

• Acting as a key user and administrator of supplier onboarding and due diligence platforms, including supporting process improvements, reporting and workflow automation. 

Governance and Reporting 

• Maintaining accurate and up-to-date records, including: 

• Supplier Risk Register  

• CRM and third-party due diligence software 

• Renewal and review schedules 

• Assessment outcomes, approvals and key correspondence 

• Supplier risk findings, remediation actions, approval conditions, exceptions and risk acceptance, including owners and target dates 

• Initiating, managing and tracking periodic supplier reviews in line with agreed schedules and risk-based requirements. 

• Coordinating reassessment where there are material changes to the supplier, service, approved use case, data processing or changes impacting wider risk profile. 

• Identifying, assessing and escalating supplier incidents, concerns and changes in risk profile, ensuring appropriate follow-up action is taken. 

• Prepare reports, summaries and approval papers. 

• Contributing to management information and committee reporting, including supplier risk trends and emerging issues. 

• Contributing to the continued development of risk-based supplier management practices across the firm. 
• Coordinating and challenging stakeholders to ensure onboarding requests progress in a timely manner and required information is provided. 

Key Competencies 

• Excellent attention to detail. 

• Strong analytical and problem-solving skills. 

• Strong organisational and project coordination skills. 

• Ability to manage multiple workstreams and competing priorities simultaneously. 

• Strong written and verbal communication skills. 

• Ability to build effective relationships across the business and with external suppliers. 

• Pragmatic and risk-aware negotiation and decision-making skills. 
• Confidence engaging with senior stakeholders.  

Essential Experience 

• 3 - 5 years’ experience in a governance, supplier management, procurement or operational risk role. 

• Strong working knowledge of risk management, information security and data protection principles. 

• Experience supporting supplier onboarding or procurement processes, including contractual negotiation. 

• Experience gathering and analysing information from multiple sources. 

• Experience coordinating activities across different business teams. 

• Experience maintaining records, registers or governance documentation. 

• Strong organisational and administrative skills. 

• Ability to translate technical, legal, and operational issues into clear business recommendations. 

Desirable Experience 

• Experience within a law firm, professional services or regulated environment. 

• Good working knowledge of UK and EU GDPR data protection principles. 

• Familiarity with risk assessment and governance approval frameworks. 

• Exposure to technology, AI or supplier governance and risk assessments.  

• Experience using OneTrust or similar third-party risk management, GRC or supplier onboarding platforms.