In this role, you will be responsible for:
Maintaining the third party and ICT third party inventory, including:
• Cboe Europe’s outsourcing register and DORA register of information, ensuring ICT services supporting critical or important functions are correctly identified, classified, and recorded.
• The register of material third party arrangements required under FCA PS26/2 and FG26/4, kept submission-ready for return to the FCA.
• Mapping of third parties to the business services, functions, processes, assets, and controls they support, including impact tolerances, RTOs, and RPOs.
• Subcontracting and nth-party chains for ICT services supporting critical or important functions, with concentration, substitutability, and geographic risk recorded.
• Automated data quality, reconciliation, and evidence-gathering controls so register data stays accurate, complete, and examination-ready.
• Strengthening our First Line of Defence (1LOD) through robust procedures and controls aligned to Cboe’s Third Party Management Policy, and a culture of continuous improvement
Running first-line third party risk assessment, due diligence, and contracting by:
• Acting as the first point of contact for business owners on third party or outsourcing matters, guiding them through onboarding, including: risk assessment, contract review, and the approval process; approval decisions remain with business owners, subject to second-line sign-off for high-risk vendors.
• Running proportionate, risk-based due diligence across information security, resilience, data protection, financial crime, financial soundness, and concentration risk, coordinating with subject matter experts to form a pragmatic view of third party relationships.
• Performing the initial criticality and materiality assessment, applying DORA and FCA/PRA criteria to assess whether an arrangement supports a critical or important function or constitutes a material third party arrangement, subject to second-line review and challenge.
• Working with Legal and Procurement to embed the DORA Article 30 contractual requirements, including service descriptions, data and processing locations, audit and access rights, subcontracting conditions, security and resilience requirements, incident assistance, and termination rights.
• Documenting exit strategies, substitutability analysis, and stressed exit plans for ICT services supporting critical or important functions.
• Working closely with Operational Resilience SMEs to design and deliver third party related resiliency testing, including severe but plausible supplier failure scenarios and, where in scope, the inclusion of third parties in relevant information security testing.
Leading first-line implementation for third party risk by:
• Supporting first line teams with assessment, business impact analysis, and implementation planning for DORA Chapter V on ICT third party risk
• Translating FCA PS26/2 and FG26/4 on material third party reporting into operational processes, technology changes, and first-line controls ahead of the 18 March 2027 implementation date.
• Coordinating cross-functional implementation with Technology, Operations, Legal, Procurement, and Product, embedding first-line control self-testing as the framework matures, and representing Third Party Management activities with second-line Compliance and Operational Risk.
Supporting third party governance, monitoring, and regulatory reporting by:
• Running the ongoing monitoring programme, including performance and service level reviews, control attestations, right-to-audit activity, and periodic re-assessment of material and critical third parties.
• Preparing regulatory returns and notifications for review and submission by the second line (Compliance), including the DORA register of information, the FCA register of material third party arrangements, and notifications of new or significantly changed material third party arrangements.
• Working with compliance SMEs for operational and ICT incident reporting where a third party is involved, providing third party information to support Compliance’s assessment against regulatory reporting criteria for UK and European entities.
• Maintaining third party risk management information and reporting to senior management, internal committees, and auditors.
• Tracking and reporting remediation of due diligence findings, control gaps, audit actions, and contractual remediation programmes.
• Acting as a key partner to the Operations, Technology, and Procurement functions.