Risk Analyst

Our financial services client is seeking a Risk Analyst (10+ years of experience) to assess supplier security controls and negotiate contractual security obligations using third-party risk frameworks and security standards- 58851

Join a procurement and cybersecurity initiative focused on supplier risk and security within a large banking environment. This role supports supplier security schedule reviews, third-party risk advisory activities, and coordination across Procurement, Legal, Security, and Technology Risk stakeholders. The position offers exposure to ongoing transformation initiatives and complex supplier security negotiations within enterprise procurement. The engagement includes onboarding and knowledge transfer with the expectation to quickly contribute across active negotiations and risk reviews.

Location: Toronto or Mississauga- 4 days a week on site

Duration: 10 Months (Chance of Extension)

Hours: 37.5 Hours Per Week

Must Haves

• 10+ years within information security, cybersecurity, technology risk, or third-party/vendor risk
• 8+ years assessing supplier security controls and third-party technology risks across cloud, SaaS, outsourcing, or managed services
• Working knowledge of NIST, ISO/IEC 27001/27002, and SOC 1/SOC 2 reports
• Experience interpreting contractual security language, negotiating supplier exceptions, and working with Procurement, Legal, and Security stakeholders
• Diploma or Bachelor’s degree

Nice to Have

• Banking or financial institution experience
• Certifications such as CISSP, CISM, CISA, or CRISC
• Knowledge of Contract Lifecycle Management (CLM)
• MS Office Suite proficiency

Responsibilities

• Review supplier redlines, exceptions, substitutions, and qualification language affecting security obligations
• Assess proposed alternative controls against supplier services, delivery models, data access, and risk profiles
• Translate technical security requirements into contractual implications and negotiation recommendations for Procurement
• Support sourcing and contract managers during supplier security discussions and negotiations
• Coordinate input from Security, Legal, and Technology Risk stakeholders on supplier security-contracting matters
• Prepare decision papers outlining proposed changes, risks, recommendations, and approval requirements
• Maintain audit trails of advice, approvals, deviations, and negotiated contract positions