ABOUT US

We’re the world’s leading provider of secure financial messaging services, headquartered in Belgium. We are the way the world moves value – across borders, through cities and overseas. No other organisation can address the scale, precision, pace and trust that this demands, and we’re proud to support the global economy. 

We’re unique too. We were established to find a better way for the global financial community to move value – a reliable, safe and secure approach that the community can trust, completely. We’re always striving to be better and are constantly evolving in an ever-changing landscape, without undermining that trust. Five decades on, our vibrant community reflects the complexity and diversity of the financial ecosystem. We innovate diligently, test exhaustively, then implement fast. In a connected and exciting era, our mission has never been more relevant. Swift now has a presence in 200+ countries and legal territories to serve a community of more than 12,000 banks and financial institutions.

Job Summary

Lead the Third-Party Security Due Diligence function for SWIFT, ensuring that third-party suppliers, technology providers, cloud services, and strategic partners are assessed, onboarded, and monitored in line with SWIFT's security, resilience, regulatory, and operational risk requirements.

The role is responsible for managing the end-to-end security due diligence lifecycle, providing expert risk-based assessments of third parties, driving remediation activities, and supporting compliance with applicable regulatory frameworks including DORA, NIS2, ISO 27001, and SWIFT's internal security standards.

Key Responsibilities

Security Due Diligence & Risk Assessment

• Lead the end-to-end third-party security due diligence process, from supplier onboarding through ongoing assurance, reassessment, and offboarding.
• Perform comprehensive security risk assessments of third parties, evaluating cybersecurity, resilience, data protection, cloud security, supply chain security, and operational risk exposures.
• Assess supplier security capabilities through review of questionnaires, policies, certifications, audit reports, penetration testing results, independent assurance reports, and supporting evidence.
• Evaluate control effectiveness against recognised frameworks and standards including ISO 27001, NIST Cybersecurity Framework, SOC reports, DORA, and relevant SWIFT security requirements.
• Identify security gaps, residual risks, and compensating controls, providing clear risk ratings and recommendations to stakeholders.

Supplier Assurance & Continuous Monitoring

• Establish and maintain a risk-based supplier assurance programme for critical and high-risk third parties.
• Drive remediation activities with suppliers and internal stakeholders to address identified security weaknesses and control deficiencies.
• Support ongoing monitoring activities, including reassessments, threat monitoring, breach notifications, security events, and changes in supplier risk profiles.
• Monitor supplier compliance with contractual security obligations and regulatory requirements.

Stakeholder Management & Advisory

• Partner closely with Procurement, Legal, Technology, Architecture, Operational Risk, Compliance, Data Protection, and Business teams to support supplier onboarding and risk decisions.
• Provide expert guidance on third-party security risks, risk acceptance decisions, mitigating controls, and supplier onboarding requirements.
• Present security due diligence outcomes, key risks, and recommendations to governance forums, senior management, and risk committees.
• Act as the subject matter expert for third-party security risk management and supplier assurance activities across the organisation.

Governance & Regulatory Compliance

• Contribute to the development and continuous improvement of SWIFT's Third-Party Security Risk Management and Supplier Assurance frameworks, methodologies, standards, and procedures.
• Ensure due diligence activities align with regulatory expectations and industry best practices, including DORA, NIS2, GDPR, EBA Guidelines, and relevant financial sector requirements.
• Support internal audits, regulatory reviews, and external examinations relating to third-party security risk management.
• Develop management reporting, KPIs, KRIs, and board-level metrics to demonstrate programme effectiveness and risk exposure.

Qualifications & Experience

Essential

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Risk Management, Information Systems, or a related discipline.
• Minimum 7 years' experience in cybersecurity, third-party security risk management, supplier assurance, security assurance, or technology risk within financial services, critical infrastructure, or a highly regulated environment.
• Strong understanding of third-party security risk management practices and supplier assurance methodologies.
• Practical experience conducting security assessments of cloud providers, SaaS vendors, technology suppliers, and outsourced service providers.
• Strong understanding of security frameworks and standards including ISO 27001, NIST, SOC 1/2, CIS Controls, and cloud security best practices.
• Experience evaluating security controls across identity management, network security, encryption, vulnerability management, incident response, resilience, data protection, and secure software development.
• Excellent risk analysis, stakeholder management, and report-writing skills.
• Ability to communicate complex security risks clearly to technical and non-technical audiences, including senior executives.

Desirable

• Experience supporting regulatory requirements such as DORA, NIS2, EBA Guidelines on Outsourcing, FCA/PRA regulations, or equivalent frameworks.
• Experience in financial services, payments, or highly regulated environments.
• Familiarity with supply chain security, concentration risk, AI supplier assessments, and cloud service provider due diligence.
• Certifications such as CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 Lead Auditor, or equivalent.
• Experience using Governance, Risk & Compliance (GRC) platforms and third-party risk management tools.

Success Measures

• Timely completion of third-party security assessments.
• Effective identification and treatment of supplier security risks.
• Strong stakeholder satisfaction and onboarding support.
• Successful support of regulatory, audit, and assurance activities.
• Continuous improvement of the third-party security risk and supplier assurance programme.