CyberSecurity Risk Analyst

BeachHead Inc.; Toronto; On-site; CAD 92,000 - 110,000; Full time

Job summary

BeachHead Inc. is seeking a CyberSecurity Risk Analyst to evaluate supplier security controls, negotiate security obligations, and support third-party risk frameworks within the procurement team.

The role involves working with a top financial client to strengthen risk posture across procurement activities. The position focuses on translating security requirements into contractual strategies and supporting risk mitigation in a dynamic banking environment, including cloud, SaaS, and outsourcing

Qualifications

• 10+ years of experience in information security, cybersecurity, technology risk, or a closely related discipline.
• 8+ years assessing supplier security controls, including cloud, SaaS, and outsourcing.
• Working knowledge of security frameworks such as NIST, ISO/IEC 27001/27002, and SOC 1/SOC 2.
• Experience interpreting contractual security language and negotiating exceptions.
• Ability to communicate complex technical issues in clear business language.

Responsibilities

• Review supplier redlines, exceptions, proposed substitutions, and qualification language affecting security obligations.
• Assess whether alternative controls provide comparable protection, considering the supplier’s services, delivery model, and risk profile.
• Translate technical security requirements into clear contractual and negotiation strategies for Procurement.
• Support sourcing and contract managers in supplier discussions, explaining requirements and documenting rationales.
• Identify contractual changes that may weaken security obligations and differentiate routine drafting from substantive control or risk alterations.
• Apply knowledge of security policies, third-party risk frameworks, and applicable regulatory requirements to advise on supplier risk.
• Consider supplier access to information, systems, environments, and services, including cloud, SaaS, and outsourcing.
• Support alignment between security requirements and risk assessments, control evaluations, and contractual obligations.
• Act as Procurement’s primary point of contact for supplier security-related inquiries, coordinating with Security, Legal, and Technology Risk teams.
• Resolve issues within delegated authority; escalation deviations and risk acceptance decisions as needed.
• Prepare decision papers that outline proposed changes, risks, options, and recommendations.
• Maintain an audit trail of advice, approvals, and negotiated positions.
• Assist in maintaining security contracting playbooks, clause guidance, and negotiation templates.
• Identify common supplier objections and recommend improvements to standard clauses and processes.
• Provide training to sourcing teams on security clause interpretation and escalation procedures.

Skills

Security leadership

Risk assessment

Contract interpretation

Communication

CLM

MS Office

Tools

MS Office Suite

Job description

Are you experienced in supplier security and third-party risk management?

Working with one of our top financial clients, this role calls for a CyberSecurity Risk Analyst. This position involves evaluating supplier security controls, negotiating contractual security obligations, and supporting financial and third-party risk frameworks within the procurement team. The role offers an excellent opportunity to contribute to risk mitigation initiatives and gain valuable experience in a dynamic banking environment.

Pay rate range (CAD): $66.67/hr - $80.00/hr

Responsibilities

• Review supplier redlines, exceptions, proposed substitutions, and qualification language affecting security obligations.


• Assess whether alternative controls provide comparable protection, considering the supplier’s services, delivery model, and risk profile.


• Translate technical security requirements into clear contractual and negotiation strategies for Procurement.


• Support sourcing and contract managers in supplier discussions, explaining requirements and documenting rationales.


• Identify contractual changes that may weaken security obligations and differentiate routine drafting from substantive control or risk alterations.


• Apply knowledge of security policies, third-party risk frameworks, and applicable regulatory requirements to advise on supplier risk.


• Consider supplier access to information, systems, environments, and services, including cloud, SaaS, and outsourcing.


• Support alignment between security requirements and risk assessments, control evaluations, and contractual obligations.


• Act as Procurement’s primary point of contact for supplier security-related inquiries, coordinating with Security, Legal, and Technology Risk teams.


• Resolve issues within delegated authority; escalation deviations and risk acceptance decisions as needed.


• Prepare decision papers that outline proposed changes, risks, options, and recommendations.


• Maintain an audit trail of advice, approvals, and negotiated positions.


• Assist in maintaining security contracting playbooks, clause guidance, and negotiation templates.


• Identify common supplier objections and recommend improvements to standard clauses and processes.


• Provide training to sourcing teams on security clause interpretation and escalation procedures.

Desired Skill-Set

• 10+ years of experience in information security, cybersecurity, technology risk, or a closely related discipline.


• 8+ years assessing supplier security controls, including cloud, SaaS, and outsourcing.


• Working knowledge of security frameworks such as NIST, ISO/IEC 27001/27002, and SOC 1/SOC 2.


• Experience interpreting contractual security language and negotiating exceptions.


• Ability to communicate complex technical issues in clear business language.


• Strong understanding of Contract Lifecycle Management (CLM).


• Proficiency with MS Office Suite.


• Excellent communication and presentation skills.


• Ability to train and transfer knowledge to procurement teams.

Nice to Have

• Experience within banking or financial institutions.


• Relevant certifications such as CISSP, CISM, CISA, or CRISC.

BeachHead is an equal opportunity agency and employer. We advocate for our candidates and welcome applicants regardless of race, color, religion, national origin, sex, age, or physical or mental disability. BeachHead or our clients may use technology-enabled tools, including automation and artificial intelligence (AI), to support parts of the recruitment process such as resume screening, application management, and candidate matching. These tools assist our recruiters and our clients, and do not replace human decision-making. This job posting represents a current or anticipated vacancy. The position may be filled at any time, and the posting may be removed without notice once the role has been filled.