Third Party Security Analyst

We’re BDO. An accountancy and business advisory firm, providing the advice and solutions entrepreneurial organisations need to navigate today’s changing world.

We work with the companies that are Britain’s economic engine – ambitious, entrepreneurially-spirited and high‑growth businesses that fuel the economy – and directly advise the owners and management teams leading them.

We’ll broaden your horizons

The Quality and Risk Management Team (QRM) provides leadership, guidance, and tools to help partners and staff manage quality and risk matters. The team is comprised of an Advisory and Compliance Team, a Chief Information Security Office Team, an Economic Crime Team, a Legal Team including a Commercial & Contracts Team, the Independence and Ethics Team and the Regulatory Supervisory Team, plus the Quality Monitoring Team. The team works closely with the firm’s Technical Standards Group and the firm’s leadership.

We’ll help you succeed

Leading organisations trust us because of the quality of our advice. That quality grows from a thorough understanding of their business, and that understanding comes from working closely with them and building long-lasting relationships.

You’ll be someone who is both comfortable working proactively and managing your own tasks, as well as confident collaborating with others and communicating regularly with senior managers, directors, and BDO’s partners to help businesses effectively. You’ll be encouraged to identify and draw attention to opportunities for enhancing our delivery and providing additional services to organisations we work with.

Role Purpose

TheThird Party Security Analyst (Manager grade)is responsible for the implementation of the BDO third party security framework. This includes assessing the information security risks of our 3rd parties, by evaluating the 3rd parties' security controls and ensuring supplier and supply chain information security risks to BDO and BDO client services are identified, assessed and managed.

This role reports to the Information Security Manager.

Principal Accountabilities

• Leads in the execution and continuous improvement of the information security supply chain framework, which includes ensuring that security controls are implemented within the supply chain lifecycle at BDO.
• Coordinates the BDO supplier and supply chain information security due diligence framework and delivery of service to stakeholders.
• Supports risk-based planning for supplier information security due diligence and risk assessment activities.
• Partners with procurement, contract management and other key stakeholders to ensure the end-to-end third-party processes consider information security.
• Coordinates the gathering of vendor risk assessment data and prepares risk assessments for vendors as needed, to be published and communicated to stakeholders.
• Understands and applies relevant regulatory and legal compliance requirements.
• Assesses vendor risks against BDO contractual requirements and controls.
• Assesses third party vendor regulatory compliance.
• Conducts due diligence and assessments of third-party security controls and posture.
• Coordinates the identification and ranking of vendor risks.
• Coordinates the classification and tiering of vendors by risks and risk impacts.
• Communicates identified risk requirements to internal stakeholders.
• Builds communication and escalation plans around vendor risk management activities.
• Ensures that vendor remediation actions, mitigation and contingency plans are identified and communicated to business owners.
• Tracks identified risks and risk events through the supplier lifecycle.
• Maintains required activity and risk metrics and other data.
• Reports on activities related to third party supplier assurance as required.
• Collates, analyses, and tracks evidence provided and gathered via direct and indirect external sources to understand information security supply chain risk.
• Supports review and continual improvement of information security supplier due diligence and risk assessment procedures.
• Together with legal, develops and maintains a set of security contractual clauses and service level agreements.

Knowledge and Experience

• Demonstrable experience with supplier and supply chain due diligence frameworks, procedures, data gathering and information security risk and controls assessment.
• Experience of supplier information security risk management at all stages of the supplier lifecycle from procurement, contracting, on-boarding, contract management and off-boarding.
• Experience with business service, system and data architectures.
• Experience of information security audit and assurance.
• Familiarity with formal information security frameworks and certifications such as SOC 2, ISO27001, CE+, CIS top 20, OWASP.
• Experience with contract review of information security schedules and terms.
• Excellent verbal, written and interpersonal communication skills. Listens and communicates technical subjects to both technical and nontechnical audiences, flexes style to suit the needs of the audience.
• Excellent stakeholder engagement and management experience and skills with the ability to understand complex business structures and services and to advise senior stakeholders on information security risks, mitigations and management strategies.
• Self-motivated with keen attention to detail.
• Have a relevant industry certification such as CISSP, CISM, CRISC or equivalent.

NB: The above list of job duties is not exclusive or exhaustive and the post holder will be required to undertake such tasks as may reasonably be expected within the scope and grading of the post. Job descriptions should be regularly reviewed to ensure they are an accurate representation of the post.