Cyber Risk and Exposure Management Lead

Job Title: Cyber Risk and Exposure Management Lead 

Division: Operations 

Department: Cyber & Information Resilience (C&IR) 

• Salary: National (Edinburgh and Leeds) ranging from £60,700 to £80,700 and London from £66,600 to £88,600 per annum (salary offered will be based on skills and experience) 

• This role is graded as: Lead Associate - Regulatory 

• Your external recruitment contact is Benjamin via [email protected]   

• Your internal recruitment contact is Lauren via [email protected] Applications must be submitted through our online portal. Applications sent via social media or email will not be accepted. 

 About the FCA and team  

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth, and shaping the future of UK finance services.  

As Cyber Risk and Exposure Management Lead, within Cyber Assurance, you will manage and, develop and lead a team, that will provide strategic and operational leadership across exposure management and GRC, enabling coordinated, risk-based action to improve the FCA’s cyber security posture. You will be responsible for exposure management, cyber governance, risk and compliance (GRC), and oversee the cyber assurance security testing, including penetration testing and the evolving AI red teaming capability. 

 
Main priorities will be to deliver the FCA’s Continuous Threat Exposure Management (CTEM) roadmap, lead GRC tooling and set the GRC strategy, as well as oversee control effectiveness assessments, coordinate risk-based remediation priorities such as owning the Cyber Assurance Risk Register and produce clear cyber risk reporting for senior decision-makers. 

Role responsibilities 

• Lead the FCA’s exposure management transformation and Continuous Threat Exposure Management (CTEM) workstream, setting the strategy and maturity roadmap for continuous, risk-based identification, prioritisation and management of cyber exposures 

• Embed CTEM across Product Groups, business stakeholders and senior leaders, securing agreement on responsibilities and collaborative ways of working to reduce cyber exposure across the organisation 

• Set the cyber-Governance, Risk and Compliance (GRC) strategy and maturity priorities across risk governance, control assurance and reporting, while leading the central cyber risk reporting capability 

• Lead control effectiveness assessments with control owners and specialists, evaluating evidence, identifying gaps and driving improvements that strengthen the FCA’s overall cyber security posture 

• Define and oversee the GRC tooling strategy, agreeing requirements and prioritising enhancements with suppliers and internal stakeholders to improve reporting consistency, insight and decision-making 

• Coordinate monthly and quarterly reporting for the CISO and COO, bringing together cross-functional input to deliver clear cyber risk insights, control effectiveness assessments, KPIs and KRIs that support senior decision-making 

• Own the Cyber Assurance Risk Register and lead FCA-wide remediation prioritisation, ensuring risks, treatment plans and actions remain current while balancing risk reduction, dependencies and delivery feasibility 

• Lead and develop the Cyber Risk and Exposure team, oversee organisational penetration testing, support the establishment of AI red teaming capability, and provide strategic direction, assurance and escalation across all areas of the function 

Skills required  

Minimum: 

• Demonstrated expertise in cyber risk and exposure management, including practical application of CTEM, successfully assessing the relationship between technical findings, control effectiveness, business context and remediation priorities to support risk-based decision-making 

• Previous experience of delivering cyber GRC activities across risk registers, control effectiveness assessments, GRC tooling and evidence-based reporting, providing clear risk insights and recommendations to senior stakeholders and governance forums 

• Expertise in applying cyber security frameworks, particularly NIST CSF 2.0, to assess controls, strengthen cyber risk governance and improve security posture, translating complex technical cyber risks into clear, actionable remediation options for operational teams and senior decision-makers 
• Line management experience, including setting priorities, developing specialist cyber security professionals, providing strategic leadership and acting as a clear escalation point across the function 

Essential: 

• Excellent stakeholder management skills, with a proven ability to engage and influence stakeholders at all organisational levels, challenge technical partners and senior leaders, and successfully embed new ways of working without direct ownership of controls or remediation activity 

• Demonstrable experience leading and maturing cyber risk, exposure management or assurance capabilities, setting strategic direction and delivering practical roadmaps that drive measurable capability improvement 

• Experience coordinating risk-based prioritisation of cyber findings, remediation activities, risk registers and treatment plans, securing senior stakeholder decisions while maintaining clear accountability for mitigation, residual risk management and escalation 

• Proven track record leading control effectiveness assessments, identifying control improvements and translating outcomes into cyber risk insights and security posture reporting for governance and decision-making 

• Experience leading the development and enhancement of GRC tooling and reporting capabilities, working with third-party suppliers to define requirements, prioritise enhancements and support organisational maturity 

Benefits 

• 25 days annual leave plus bank holidays 

• Colleagues spend a minimum of 50% of their working time in the office each month (60% for Directors and Executive Directors) across our London, Leeds and Edinburgh offices 

• Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary 

• Private healthcare with Bupa, income protection, and 24/7 Employee Assistance 

• 35 hours of paid volunteering annually 

• A flexible benefits scheme designed around your lifestyle 

For a full list of our benefits, and our recruitment process as a whole visit our benefits page. 

Our values & culture  

Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference, and supports colleagues to deliver at their best. We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation, and delivers better regulation. 

If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support. 

We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part-time and job sharing where applicable. 

Disability Confident: our hiring approach  

We’re proud to be a Disability Confident Employer, and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes, we may progress applicants whose experience most closely matches the role’s key requirements. 

Useful information and timeline 

• Advert Closing: 11:59pm on Sunday 29th November 2026

• CV Review/Shortlist: Wednesday 2nd December 2026

• First Stage Screening Calls W/C: 7th December 2026

• Second Stage interviews W/C: 14th December 2026

• Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.   

• SC Clearance is required for this role (SC Guidance) - you will hold or will be required to obtain Security Check (SC) level vetting