Senior DORA Programme Manager - Third-Party Risk

Senior DORA Programme Manager - Third-Party Risk & Regulatory Remediation

Location: London, UK
Working Arrangement: Hybrid - 8 days onsite per month in London; remainder remote
Contract: Inside IR35 (Umbrella Company)
Sector: Financial Services / Banking / Financial Market Infrastructure

ABOUT THE OPPORTUNITY

We are supporting a leading global financial services organisation seeking an experienced Senior DORA Programme Manager to lead procurement and supplier management regulatory remediation under the Digital Operational Resilience Act (DORA) and related regulatory frameworks.

This is a high-profile delivery role covering ICT third-party risk management (TPRM), outsourcing governance, supplier contract remediation, procurement controls, operational resilience and regulatory compliance. You will coordinate Procurement, Legal, Risk, Operational Resilience, Technology and Business teams to ensure obligations are implemented, evidenced and embedded into business-as-usual operations.

We are particularly interested in candidates who have personally led DORA or equivalent regulatory remediation programmes within major financial institutions.

KEY RESPONSIBILITIES

DORA Regulatory Remediation

• Lead procurement-related DORA workstreams, including ICT third-party contract uplift and supplier due diligence.
• Remediate the Register of Information (ROI), improving supplier data quality, classification and regulatory reporting readiness.
• Oversee supplier inventories, critical and important function (CIF) assessments, tiering and materiality reviews.
• Coordinate operational resilience requirements, regulatory evidence collection and audit preparation.

Supplier Contract Remediation

• Lead remediation of supplier agreements to meet DORA requirements, including audit and regulatory access rights, subcontracting, material change notifications, data location and processing, exit assistance, termination rights, business continuity and incident management.
• Work with Legal, Procurement and suppliers to negotiate, track and complete contractual uplift activities.

Register of Information (ROI)

• Coordinate collection, validation and reconciliation of supplier and internal data.
• Oversee supplier mapping, critical provider identification, data quality improvements and regulatory classification.
• Establish clear ownership, governance and processes for ongoing regulatory reporting.

Subcontractor Governance

• Establish subcontractor declarations, supply chain visibility and mapping, and identification of material subcontractors.
• Assess concentration risk and implement KPI/KRI reporting, oversight controls and regulatory evidence management.

Supplier Exit Planning

• Develop supplier exit strategies, plan inventories, gap assessments and remediation roadmaps.
• Track accountable owners, exit testing readiness and evidence of compliance.
• Ensure exit plans are maintained and owned by the relevant business functions.

Programme Governance & Stakeholder Management

• Lead steering committees, working groups and senior stakeholder engagement.
• Coordinate Procurement, Legal, Risk, Compliance, Technology and Business workstreams.
• Manage milestones, risks, dependencies, actions and delivery challenges.
• Produce executive, risk committee, internal audit and regulatory reporting.
• Drive closure of regulatory findings and embed sustainable BAU governance.

ESSENTIAL EXPERIENCE

• 10+ years' experience in procurement, supplier management, outsourcing governance or regulatory change programmes.
• Proven delivery of large-scale regulatory remediation programmes in financial services.
• Strong working knowledge of DORA, EBA Outsourcing Guidelines, EBA ICT & Security Risk Guidelines, operational resilience regulations and ICT third-party risk frameworks.
• Demonstrable experience leading supplier contract remediation and contractual uplift programmes.
• Hands-on experience implementing or remediating DORA Registers of Information and outsourcing registers.
• Experience establishing supplier governance, subcontractor oversight and supplier exit planning frameworks.
• Experience working with regulators, internal audit and second-line risk functions.
• Strong programme leadership, executive reporting and cross-functional stakeholder management skills.

HIGHLY DESIRABLE

• DORA implementation or remediation within a European financial institution.
• Experience with ECB, NBB, FCA, PRA, EBA or comparable regulatory programmes.
• Knowledge of GDPR, Schrems II, cross-border data transfers and cloud provider compliance.
• Background in securities, banking, payments or financial market infrastructure.
• Experience at a Tier 1 European bank, market infrastructure organisation or Big Four regulatory advisory practice.

KEY SKILLS

DORA EBA Outsourcing Operational Resilience ICT Third-Party Risk Outsourcing Governance Supplier Risk Procurement Controls Contract Remediation Vendor Management Cloud Governance GDPR Schrems II Regulatory Change Programme Management Executive Reporting

EXPECTED DELIVERABLES

• Completed DORA supplier contract uplift programme.
• Accurate, regulator-ready Register of Information.
• Subcontractor governance framework and KPI/KRI reporting.
• Supplier exit plan inventory and remediation roadmap.
• Executive and regulatory reporting packs.
• Closure of regulatory findings and remediation actions.
• Sustainable business-as-usual supplier governance model.

Rates depend on experience and client requirements