Risk Analyst V – Toronto

Our client, is seeking an experienced, highly detail-oriented Risk Analyst V (Supplier Security & Third-Party Risk Advisory Specialist) to join their enterprise technology risk and procurement advisory group.

In this strategic, high-visibility role, you will act as the primary point of contact for supplier security contracting questions and third-party risk assessments.

Working in a hybrid capacity, you will review supplier redlines, assess alternative controls, and translate technical cybersecurity requirements into clear contractual positions and negotiation guidelines for Procurement and Legal teams.

You will evaluate supplier risks across cloud, Saa S, and managed service environments, aligning contractual security provisions with internal risk control frameworks and applicable financial services regulatory expectations (such as OSFI standards).

Duration: 10-Month Contract (Full-time engagement).

Work

Arrangement: Hybrid (4 days per week on-site at corporate offices; 1 day work from home; flexible anchor days).

• Advantages
• High-Visibility Strategic Scope: Serve as the core bridge between Procurement, Legal, Cybersecurity, and Technology Risk teams on major enterprise vendor contracts.
• Complex
• Risk

Negotiations: Drive high-value contract redlines, evaluating security provisions, incident response triggers, and data protection clauses for public cloud and Saa S integrations.

• Enterprise Governance Impact: Maintain and optimize security-contracting playbooks, negotiation matrices, and fallback clause guidance across the organization.
• Balanced Hybrid Model: Enjoy workplace flexibility with a 4-day on-site and 1-day remote work schedule.

Responsibilities

• Supplier Security Schedule Review & Negotiation: Review supplier redlines, exceptions, and proposed alternative controls affecting security obligations, evaluating risks across cloud, Saa S, and technology-enabled arrangements.
• Procurement & Legal

Collaboration: Partner directly with sourcing managers and legal teams during supplier discussions, explaining technical security requirements, documenting rationale, and proposing acceptable fallback language.

• Third-Party Risk Advisory & Regulatory

Alignment: Apply knowledge of enterprise security frameworks, third-party risk management policies, and financial services regulatory expectations (including OSFI guidelines) to supplier agreements.

• Contractual
• Impact

Assessment: Identify clause changes affecting incident notification timelines, audit/assurance rights, access controls, data protection, subcontracting, and termination/exit obligations.

• Stakeholder Escalation & Decision

Papers: Prepare concise decision papers for leadership summarizing proposed changes, risk implications, and recommendations; maintain complete audit trails of approvals and negotiated positions.

• Playbook Governance & Enablement: Help maintain security-contracting playbooks and fallback clause guidance while training procurement and contract management teams on security clause interpretations.

Qualifications

• Information Security & Risk

Depth: 10+ years of dedicated professional experience within information security, cybersecurity, technology risk, or third-party/vendor risk management (TPRM).

• Supplier & Cloud
• Risk

Assessment: 8+ years of hands-on experience assessing supplier security controls and third-party technology risks (cloud, Saa S, outsourcing, managed services).

• Security Framework Knowledge: Deep working knowledge of security and assurance frameworks, including NIST, ISO/IEC 27001/27002, and SOC 1 / SOC 2 audit reports.
• Contract Language & Negotiation

Experience: Proven track record interpreting complex contractual security language, negotiating supplier redlines, and partnering with Procurement and Legal teams.

• CLM & Tools Proficiency: Strong expertise working with Contract Lifecycle Management (CLM) platforms and Microsoft Office Suite.
• Communication & Training

Abilities: Exceptional written and verbal communication skills, with a proven ability to present complex technical issues in clear business terms and deliver training to internal stakeholders.

• Preferred Assets & Nice-to-Haves
• Experience working within a major bank, financial institution, or highly regulated corporate environment.
• Industry certifications such as CISSP, CISM, CISA, or CRISC (or equivalent practical experience).
• Summary

If you are a tech-savvy Risk Analyst V who pairs 10+ years of information security and third-party risk management expertise with strong supplier contract negotiation skills, NIST/ISO framework knowledge, and Contract Lifecycle Management (CLM) experience, this 10-month hybrid contract opportunity is an ideal next step.

Bring your risk advisory precision, contractual acumen, and collaborative drive to our team today!

Randstad Canada is committed to fostering a workforce reflective of all peoples of Canada.

As a result, we are committed to developing and implementing strategies to increase the equity, diversity and inclusion within the workplace by examining our internal policies, practices, and systems throughout the entire lifecycle of our workforce, including its recruitment, retention and advancement for all employees.

In addition to our deep commitment to respecting human rights, we are dedicated to positive actions to affect change to ensure everyone has full participation in the workforce free from any barriers, systemic or otherwise, especially equity-seeking groups who are usually underrepresented in Canada's workforce, including those who identify as women or non-binary/gender non-conforming; Indigenous or Aboriginal Peoples; persons with disabilities (visible or invisible) and; members of visible minorities, racialized groups and the LGBTQ2+ community.

This posting is for existing and upcoming vacancies.

#J-18808-Ljbffr