{"id":1917883,"url":"https://alion.io/job/clio-third-party-risk-analyst","title":"Third-Party Risk Analyst","company":{"id":5273,"name":"Clio","domain":"clio.com","url":"https://alion.io/company/clio","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Finance","role_family":"Finance","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Burnaby, Canada","Toronto, Canada","Calgary, Canada","Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":38000,"max_usd":67000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":145},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-10-05T17:05:25Z","employer_posted_date":"2026-10-05","last_verified_at":"2026-10-14T22:15:46Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely.\nWe are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice.\nSummary:\nAbout the Team\nThird-Party Risk Management (TPRM) is responsible for making sure the outside parties Clio relies on, including software vendors, service providers, and platform integrators it lists in the App Marketplace, meet Clio's bar for security and privacy before they touch Clio or customer data. We sit inside the vendor lifecycle as the security compliance review phase of Procurement, after intake and in parallel with Legal and IT. We work closely with IT, Privacy, Legal, and the App Ecosystem team to deliver strong, documented, defensible assessments of security posture and risk.\nAbout the Role\nAs a Third-Party Risk Analyst, you are the person who reads the security documentation and advises on the risk of third-party relationships. You own the day-to-day execution of the security review phase, working through vendor submissions, reviewing SOC 2 and penetration test reports, checking data handling against our requirements, and reviewing the security and privacy submissions of partners applying to list in Clio's App Marketplace. When the third party’s criticality is higher, you step up the documentation criteria and adapt. You apply an established set of criteria commensurate with the service provided, surface real risk from paperwork, and keep reviews moving.\nYou don't need to have seen every framework or every control, but you need to know what a good answer looks like, what questions to ask when something's missing, and when to escalate rather than wave something through.\nWhat You'll Do\nReview vendor security documentation submitted through the intake process, including SOC 2 reports, penetration test summaries, security whitepapers, AI disclosures, and questionnaire responses, and determine whether the vendor meets Clio's required level of security and privacy\nReview App Marketplace integration submissions and evaluate the security and privacy documentation of integration partners applying to list on Clio. Flag exceptions that could put customer data or Clio's brand at risk before a partner is added to the marketplace\nTriage for privacy review by identifying when a vendor or integration will process confidential or sensitive data and route it into a Data Privacy Impact Assessment (DPIA), partnering with Privacy/Compliance\nEscalate for risk acceptance when a risk is identified in the review process. Document and present it to the appropriate stakeholder for decision making\nMove reviews through the workflow by tracking submissions, requesting missing artifacts from requesters and vendors, responding to comments, and handing off cleanly to IT, Legal, and executive sign-off\nDocument your findings and decisions. Record what you reviewed, what you found, the risks identified, and your recommendation so the rationale is reusable and audit-ready\nMaintain the third-party risk registry\nSupport renewals and reassessments by re-reviewing vendors on renewal or change of scope\nKeep the review criteria and runbooks accurate. Follow the established process and flag when a checklist, threshold, or template is out of date or unclear\nWhat You Bring\nRequired\n2-4 years of hands-on experience in a security, compliance, GRC, vendor risk, or procurement review role\nWorking familiarity with third-party audit artifacts. You've read SOC 2 reports and know how to review them and extract a deeper understanding\nUnderstanding of core security and privacy concepts, including access controls, encryption, data classification, data residency, and what different tiers of security and privacy documentation look like\nDemonstrated ability to review documentation critically and separate real risk from noise\nComfort working within an established review process and contributing to its improvement\nClear, evidence-first written communication\nKnows when to figure something out independently and when to pull in a subject matter expert\nStrong organizational skills. You keep multiple reviews moving without losing track of what's waiting on whom\nPreferred\nYou are able to see the gaps in documentation and suggest compensating controls where applicable\nPrevious experience with GRC, TPRM, or vendor management tooling\nExposure to SOC 2, ISO 27001, PCI DSS, or GDPR/CCPA concepts in an audit context\nExperience with GDPR, CCPA, DPIAs and/or privacy impact assessments\nCISA, CIPP/CIPM, CTPRP, CompTIA Security+, or equivalent certification\nWhat Makes You a Great Fit\nYou take full ownership of your review queue, communicate effectively, and are able to balance competing priorities\nYou're curious about why a control matters, not just whether a box is checked\nYou have an intuition for looking beyond the presented facts and noticing emerging patterns across artifacts\nYou have the judgment to hold the line on a real risk and the pragmatism to keep low-risk reviews moving\nYou communicate clearly when documentation is missing, when a risk needs escalation, or when you need help. Nothing gets quietly approved\nYou're energized by helping build and sharpen a review function rather than inheriting a finished one\nYour curiosity drives you to learn the why behind the answers, questions, and processes\nThis is a new role.What you will find here:\nCompensation is one of the main components of Clio’s Total Rewards Program. We have developed a series of programs and processes to ensure we are creating fair and competitive pay practices that form the foundation of our human and high-performing culture.\nSome highlights of our Total Rewards program include:\nCompetitive, equitable salary with top-tier health benefits, dental, and vision insurance\n\nHybrid work environment, with expectation for local Clions (Vancouver, Calgary, Toronto, Dublin, London, New York City and Sydney) to be in office min. twice per week.\n\nFlexible time off policy, with an encouraged 20 days off per year.\n\n$2000 annual counseling benefit\n\nRRSP matching and RESP contribution\n\nClioversary recognition program with special acknowledgement at 3, 5, 7, and 10 years\n\nThe expected salary range for this role is $83,600 to $113,200 CAD. Initial placement within the range is informed by geographic region, experience, and skillset, with room to progress as impact and tenure grow. Final offer amounts will vary based on candidate profile.Diversity, Inclusion, Belonging and Equity (DIBE) & Accessibility\nOur team shows up as their authentic selves, and are united by our mission. We are dedicated todiversity, equity and inclusion. We pride ourselves in building and fostering an environment where our teams feel included, valued, and enabled to do the best work of their careers, wherever they choose to log in from. We believe that different perspectives, skills, backgrounds, and experiences result in higher-performing teams and better innovation. We are committed to equal employment and we encourage candidates from all backgrounds to apply.\nClio provides accessibility accommodations during the recruitment process. Should you require any accommodation, please let us know and we will work with you to meet your needs.\nLearn more about our culture atclio.com/careers\nWe're a Human and High Performing AI company, meaning we use artificial intelligence to improve all of our operations. In recruitment, AI helps us streamline the process for greater efficiency. However, we've built our systems to ensure that a human always reviews AI-generated output, and we never make automated hiring decisions.\nDisclaimer: We only communicate with candidates through official @clio.com email addresses.","description_format":"text","description_chars":7798,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible time off","Hybrid work","Vision insurance"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Legal Software"],"lifecycle":[{"event":"open","at":"2026-10-05T17:05:25Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.897,"p_room":1,"age_days":9,"expected_fill_days":31,"reasons":["conf:7","velocity","win:early","comp:junior,brand"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/clio-third-party-risk-analyst","json_url":"https://alion.io/job/clio-third-party-risk-analyst.json","meta":{"generated_at":"2026-10-15T08:16:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12602,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5273},"rest":"https://alion.io/mcp/rest/get_company?id=5273"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fclio-third-party-risk-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fclio-third-party-risk-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fclio-third-party-risk-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/clio-third-party-risk-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fclio-third-party-risk-analyst"}]}