Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely. We are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice. Third-Party Risk Management (TPRM) is responsible for making sure the outside parties Clio relies on, including software vendors, service providers, and platform integrators it lists in the App Marketplace, meet Clio's bar for security and privacy before they touch Clio or customer data.

We sit inside the vendor lifecycle as the security compliance review phase of Procurement, after intake and in parallel with Legal and IT. We work closely with IT, Privacy, Legal, and the App Ecosystem team to deliver robust, documented, defensible assessments of security posture and risk. As a Third-Party Risk Analyst, you are the person who reads the security documentation and advises on the risk of third-party relationships.

You own the day-to-day execution of the security review phase, working through vendor submissions, reviewing SOC 2 and penetration test reports, checking data handling against our requirements, and reviewing the security and privacy submissions of partners applying to list in Clio's App Marketplace. You apply an established set of criteria commensurate with the service provided, surface real risk from paperwork, and keep reviews moving. You don't need to have seen every framework or every control, but you need to know what a good answer looks like, what questions to ask when something's missing, and when to elevate rather than wave something through.

Review vendor security documentation submitted through the intake process,



including SOC 2 reports, penetration test summaries, security whitepapers, AI disclosures, and questionnaire responses, and determine whether the vendor meets Clio's required level of security and privacy Flag exceptions that could put customer data or Clio's brand at risk before a partner is added to the marketplace Triage for privacy review by identifying when a vendor or integration will process confidential or sensitive data and route it into a Data Privacy Impact Assessment (DPIA), partnering with Privacy/Compliance Escalate for risk acceptance when a risk is identified in the review process. Move reviews through the workflow by tracking submissions, requesting missing artifacts from requesters and vendors, responding to comments, and handing off cleanly to IT, Legal, and executive sign-off Record what you reviewed, what you found, the risks identified, and your recommendation so the rationale is reusable and audit-ready Maintain the third-party risk registry 2-4 years of hands-on experience in a security, compliance, GRC, vendor risk, or procurement review role ~ Understanding of core security and privacy concepts, including access controls, encryption, data classification, data residency,



and what different tiers of security and privacy documentation look like ~ Demonstrated ability to review documentation critically and separate real risk from noise ~ You are able to see the gaps in documentation and suggest compensating controls where applicable You're curious about why a control matters, not just whether a box is checked You have the judgment to hold the line on a real risk and the pragmatism to keep low-risk reviews moving You communicate clearly when documentation is missing, when a risk needs escalation, or when you need help. You're energized by helping build and sharpen a review function rather than inheriting a finished one We have developed a series of programs and processes to ensure we are creating fair and competitive pay practices that form the foundation of our human and high-performing culture.

Competitive, equitable salary with top-tier health benefits, dental, and vision insurance ~ Hybrid work environment, with expectation for local Clions (Vancouver, Calgary, Toronto, Dublin, London, New York City and Sydney) to be in office min. Flexible time off policy, with an encouraged 20 days off per year. ~$The expected salary range for this role is $83,600 to $113,200 CAD. Diversity, Inclusion, Belonging and Equity (DIBE) & Accessibility We are dedicated to diversity, equity and inclusion.

We pride ourselves in building and fostering an environment where our teams feel included, valued, and enabled to do the best work of their careers, wherever they choose to log in from. We're a Human and High Performing AI company, meaning we use artificial intelligence to improve all of our operations. In recruitment, AI helps us streamline the process for greater efficiency.

📌 Project Controls and Risk Specialist (Calgary)
🏢 Clio
📍 Calgary