Our Client a Banking company is looking for a Risk Analyst V for their Toronto ON /Mississauga ON/Hybrid location.

Responsibilities:

- Supplier Security Schedule Review and Negotiation
- Review supplier redlines exceptions proposed substitutions and qualification language affecting security obligations.
- Assess whether proposed alternative controls provide comparable protection taking account of the suppliers services delivery model data access hosting arrangements and risk profile.
- Translate technical security requirements into clear contractual implications and practical negotiation recommendations for Procurement.
- Support sourcing and contract managers in supplier discussions including explaining requirements documenting rationale and proposing acceptable wording within approved positions.
- Identify changes that weaken qualify narrow or remove security obligations and distinguish routine drafting issues from substantive control or risk changes.
- Financial services and third-party risk advisory
- Apply knowledge of the organizations security policies third-party risk framework and applicable financial-services regulatory expectations including relevant OSFI requirements as directed by internal control owners.
- Consider supplier access to information systems environments and services including cloud SaaS outsourcing and other technology-enabled arrangements.
- Identify when a supplier proposal may affect incident notification audit and assurance access controls data protection subcontracting resilience business continuity or termination/exit obligations.
- Support alignment between contractual security requirements and the supplier risk assessment and control-assessment process.
- Stakeholder coordination and escalation
- Act as Procurements primary point of contact for supplier security-contracting questions and coordinate input from Security Legal and Technology Risk.




- Resolve matters that fall within approved playbooks and delegated authority; escalate material deviations policy exceptions and risk acceptance decisions to the designated owners.
- Prepare concise decision papers identifying the proposed change relevant standard risk implication options recommendation and required approver.
- Maintain an audit trail of advice approvals deviations and final negotiated positions.
- Playbooks and process
- Help maintain security-contracting playbooks clause guidance fallback language negotiation matrices and escalation thresholds.
- Identify recurring supplier objections and recommend improvements to standard clauses guidance and sourcing processes.
- Provide training and practical guidance to sourcing managers and contract managers on security clause interpretation and escalation procedures.
- Initial contracting scope
- The position would initially focus on supplier amendments to the following provisions identified for this business case.
- The advisor should validate clause-specific requirements against the current approved agreement templates standards and playbooks before providing negotiation advice.
- Security controls
- Review supplier redlines to detailed security controls including proposed alternative controls qualifications exclusions and requests to reduce or remove obligations.
- Assess contractual and control implications and recommend positions consistent with approved security requirements.
- Public cloud provider




- Review supplier changes relating to public-cloud delivery and associated security obligations. Coordinate assessment of cloud-specific concerns and identify changes requiring input or approval from Security Technology Risk Legal or other control owners.
- Security
- Review changes to overarching security obligations and their interaction with the security schedules and related contractual provisions.
- Identify potential impacts on incident handling compliance with security requirements and consistency across the agreement.

Requirements:

- 10 years of experience within information security cybersecurity technology risk third-party/vendor risk or a closely related discipline
- 8 years of experience assessing supplier security controls and third-party technology risks including cloud SaaS outsourcing or managed services
- Working knowledge of security and assurance frameworks such as NIST ISO/IEC 27001/27002 and SOC 1/SOC 2 reports
- Experience interpreting contractual security language negotiating supplier exceptions and working with Procurement Legal and Security stakeholders
- Ability to communicate technical issues in clear business and contractual terms document decisions and manage multiple negotiations
- Strong knowledge of Contract Lifecycle Management (CLM)
- Robust knowledge of MS Office Suite
- Soft skills:
- Strong communication skills (written and verbal)
- Strong presentation skills
- Ability to train procurement teams provide knowledge transfers etc.
- Nice-to-have
- Banking or financial institution experience
- Relevant certifications such as CISSP CISM CISA or CRISC would be considered assets; equivalent practical experience should also be recognized

Why Should You Apply

- Health Benefits
- Referral Program
- Excellent growth and advancement opportunities

Required Experience:

IC

📌 Risk Analyst V (Toronto)
🏢 Iconma Portal
📍 Toronto