Are you experienced in supplier security and third-party risk management?

Working with one of our top financial clients, this role calls for a CyberSecurity Risk Analyst. This position involves evaluating supplier security controls, negotiating contractual security obligations, and supporting financial and third-party risk frameworks within the procurement team. The role offers an excellent opportunity to contribute to risk mitigation initiatives and gain valuable experience in a dynamic banking environment.

Pay rate range (CAD): $66.67/hr - $80.00/hr

Responsibilities

- Review supplier redlines, exceptions, proposed substitutions, and qualification language affecting security obligations.
- Assess whether alternative controls provide comparable protection, considering the supplier’s services, delivery model, and risk profile.
- Translate technical security requirements into transparent contractual and negotiation strategies for Procurement.
- Support sourcing and contract managers in supplier discussions, explaining requirements and documenting rationales.
- Identify contractual changes that may weaken security obligations and differentiate routine drafting from substantive control or risk alterations.
- Apply knowledge of security policies, third-party risk frameworks, and applicable regulatory requirements to advise on supplier risk.
- Consider supplier access to information, systems, environments, and services, including cloud, SaaS, and outsourcing.




- Support alignment between security requirements and risk assessments, control evaluations, and contractual obligations.
- Act as Procurement’s primary point of contact for supplier security-related inquiries, coordinating with Security, Legal, and Technology Risk teams.
- Resolve issues within delegated authority; escalation deviations and risk acceptance decisions as needed.
- Prepare decision papers that outline proposed changes, risks, options, and recommendations.
- Maintain an audit trail of advice, approvals, and negotiated positions.
- Assist in maintaining security contracting playbooks, clause guidance, and negotiation templates.
- Identify common supplier objections and recommend improvements to standard clauses and processes.
- Provide training to sourcing teams on security clause interpretation and escalation procedures.

Desired Skill-Set

- 10+ years of experience in information security, cybersecurity, technology risk, or a closely related discipline.
- 8+ years assessing supplier security controls, including cloud, SaaS, and outsourcing.
- Working knowledge of security frameworks such as NIST, ISO/IEC 27001/27002, and SOC 1/SOC 2.
- Experience interpreting contractual security language and negotiating exceptions.
- Ability to communicate complex technical issues in clear business language.
- Strong understanding of Contract Lifecycle Management (CLM).
- Proficiency with MS Office Suite.
- Excellent communication and presentation skills.
- Ability to train and

📌 CyberSecurity Risk Analyst (Toronto)
🏢 BeachHead
📍 Toronto