Third-Party Risk Analyst in Burnaby

Third-Party Risk Management (TPRM) is responsible for ensuring that the outside parties Clio relies on, including software vendors, service providers, and platform integrators listed in the App Marketplace, meet Clio's standards for security and privacy before they access Clio or customer data. We operate within the vendor lifecycle during the security compliance review phase of Procurement, collaborating closely with IT, Privacy, Legal, and the App Ecosystem team to deliver strong, documented assessments of security posture and risk.

As a Third-Party Risk Analyst, you will:

• Read security documentation and advise on the risk of third-party relationships.
• Own the day-to-day execution of the security review phase, working through vendor submissions, reviewing SOC 2 and penetration test reports, checking data handling against our requirements, and reviewing the security and privacy submissions of partners applying to list in Clio's App Marketplace.
• Adapt documentation criteria based on the criticality of the third party.
• Apply established criteria commensurate with the service provided, surface real risk from paperwork, and keep reviews moving.
• Review vendor security documentation submitted through the intake process and determine whether the vendor meets Clio's required level of security and privacy.
• Review App Marketplace integration submissions and evaluate the security and privacy documentation of integration partners.
• Triage for privacy review by identifying when a vendor or integration will process confidential or sensitive data and route it into a Data Privacy Impact Assessment (DPIA).
• Escalate for risk acceptance when a risk is identified in the review process.
• Document and present findings to appropriate stakeholders for decision making.
• Track submissions, request missing artifacts, respond to comments, and hand off cleanly to IT, Legal, and executive sign-off.
• Maintain the third-party risk registry.
• Support renewals and reassessments by re-reviewing vendors on renewal or change of scope.
• Keep the review criteria and runbooks accurate and flag when a checklist, threshold, or template is out of date or unclear.

Benefits:

• Specialized learning and development programs and access to an in-house performance coach.
• Equitable compensation for your contributions.
• Access to pay transparency on all global roles.
• Company equity for applicable employees.
• RRSP-matching in Canada, 401k in the US, and pension plans in Ireland.
• Hybrid model balancing in-person connectivity and remote flexibility.
• Flexible paid time off (4-week minimum).
• Parental leave options for birthing and non-birthing parents.
• A $500 contribution to your child's RESP.
• Various health, dental, and vision benefits for you and your family.
• Virtual and In-person Wellness Programs.
• Paid time for volunteering through our Clio Gives program.
• $2000 annual counseling benefit for CAD Clions.

Qualifications:

• Strong organizational skills.
• Understanding of core security and privacy concepts.
• 2-4 years of hands-on experience in a security, compliance, GRC, vendor risk, or procurement review role.
• Working familiarity with third-party audit artifacts.
• Comfort working within an established review process.
• Clear, evidence-first written communication.
• Demonstrated ability to review documentation critically.
• Ability to communicate effectively and balance competing priorities.
• Curiosity about why a control matters.
• Judgment to hold the line on real risk while keeping low-risk reviews moving.
• Previous experience with GRC, TPRM, or vendor management tooling.
• Exposure to SOC 2, ISO 27001, PCI DSS, or GDPR/CCPA concepts.
• Experience with GDPR, CCPA, DPIAs and/or privacy impact assessments.
• CISA, CIPP/CIPM, CTPRP, CompTIA Security+, or equivalent certification.