Cyber Risk and Exposure Management Lead

• Location: London
• Job Title:Cyber Risk and Exposure Management Lead
• Division: Operations
• Department: Cyber & Information Resilience (C&IR)
• Salary: National (Edinburgh and Leeds) ranging from £60,700 to £80,700 and London from £66,600 to £88,600 per annum (salary offered will be based on skills and experience)
• This role is graded as: Lead Associate - Regulatory
• Your external recruitment contact is Benjamin via [email protected]
• Your internal recruitment contact is Lauren via [email protected] Applications must be submitted through our online portal. Applications sent via social media or email will not be accepted.

About the FCA and team

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth, and shaping the future of UK finance services.

As Cyber Risk and Exposure Management Lead, within Cyber Assurance, you will manage and, develop and lead a team, that will provide strategic and operational leadership across exposure management and GRC, enabling coordinated, risk-based action to improve the FCA’s cyber security posture. You will be responsible for exposure management, cyber governance, risk and compliance (GRC), and oversee the cyber assurance security testing, including penetration testing and the evolving AI red teaming capability.

Main priorities will be to deliver the FCA’s Continuous Threat Exposure Management (CTEM) roadmap, lead GRC tooling and set the GRC strategy, as well as oversee control effectiveness assessments, coordinate risk-based remediation priorities such as owning the Cyber Assurance Risk Register and produce clear cyber risk reporting for senior decision-makers.

Role responsibilities

Lead the FCA’s exposure management transformation and Continuous Threat Exposure Management (CTEM) workstream, setting the strategy and maturity roadmap for continuous, risk-based identification, prioritisation and management of cyber exposures

Embed CTEM across Product Groups, business stakeholders and senior leaders, securing agreement on responsibilities and collaborative ways of working to reduce cyber exposure across the organisation

Set the cyber-Governance, Risk and Compliance (GRC) strategy and maturity priorities across risk governance, control assurance and reporting, while leading the central cyber risk reporting capability

Lead control effectiveness assessments with control owners and specialists, evaluating evidence, identifying gaps and driving improvements that strengthen the FCA’s overall cyber security posture

Define and oversee the GRC tooling strategy, agreeing requirements and prioritising enhancements with suppliers and internal stakeholders to improve reporting consistency, insight and decision-making

Coordinate monthly and quarterly reporting for the CISO and COO, bringing together cross-functional input to deliver clear cyber risk insights, control effectiveness assessments, KPIs and KRIs that support senior decision-making

Own the Cyber Assurance Risk Register and lead FCA-wide remediation prioritisation, ensuring risks, treatment plans and actions remain current while balancing risk reduction, dependencies and delivery feasibility

Lead and develop the Cyber Risk and Exposure team, oversee organisational penetration testing, support the establishment of AI red teaming capability, and provide strategic direction, assurance and escalation across all areas of the function

Skills required

Minimum

Demonstrated expertise in cyber risk and exposure management, including practical application of CTEM, successfully assessing the relationship between technical findings, control effectiveness, business context and remediation priorities to support risk-based decision-making

Previous experience of delivering cyber GRC activities across risk registers, control effectiveness assessments, GRC tooling and evidence-based reporting, providing clear risk insights and recommendations to senior stakeholders and governance forums

Expertise in applying cyber security frameworks, particularly NIST CSF 2.0, to assess controls, strengthen cyber risk governance and improve security posture, translating complex technical cyber risks into clear, actionable remediation options for operational teams and senior decision-makers

Line management experience, including setting priorities, developing specialist cyber security professionals, providing strategic leadership and acting as a clear escalation point across the function

Essential

Excellent stakeholder management skills, with a proven ability to engage and influence stakeholders at all organisational levels, challenge technical partners and senior leaders, and successfully embed new ways of working without direct ownership of controls or remediation activity

Demonstrable experience leading and maturing cyber risk, exposure management or assurance capabilities, setting strategic direction and delivering practical roadmaps that drive measurable capability improvement

Experience coordinating risk-based prioritisation of cyber findings, remediation activities, risk registers and treatment plans, securing senior stakeholder decisions while maintaining clear accountability for mitigation, residual risk management and escalation

Proven track record leading control effectiveness assessments, identifying control improvements and translating outcomes into cyber risk insights and security posture reporting for governance and decision-making

Experience leading the development and enhancement of GRC tooling and reporting capabilities, working with third-party suppliers to define requirements, prioritise enhancements and support organisational maturity

Benefits

• 25 days annual leave plus bank holidays
• Colleagues spend a minimum of 50% of their working time in the office each month (60% for Directors and Executive Directors) across our London, Leeds and Edinburgh offices
• Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
• Private healthcare with Bupa, income protection, and 24/7 Employee Assistance
• 35 hours of paid volunteering annually
• A flexible benefits scheme designed around your lifestyle
• For a full list of our benefits, and our recruitment process as a whole visit our benefits page.

Our values & culture

Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference, and supports colleagues to deliver at their best. We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation, and delivers better regulation.

If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support.

We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part-time and job sharing where applicable.

Disability Confident: our hiring approach

We’re proud to be a Disability Confident Employer, and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes, we may progress applicants whose experience most closely matches the role’s key requirements.

Useful information and timeline

Advert Closing: 11:59pm on Sunday 29th November 2026

CV Review/Shortlist: Wednesday 2nd December 2026

First Stage Screening Calls W/C: 7th December 2026

Second Stage interviews W/C: 14th December 2026

Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.

SC Clearance is required for this role (SC Guidance) - you will hold or will be required to obtain Security Check (SC) level vetting

Additional Locations: Leeds, Edinburgh