Hybrid Third-Party Risk Analyst — Security & Compliance

Clio; Calgary; Hybrid; CAD 84,000 - 113,000; Full time

Benefits offered by this job

Health benefits

Hybrid work environment

20 days off per year

Counseling benefit

RRSP matching

Job summary

Clio is seeking a Third-Party Risk Analyst to manage security reviews of vendor relationships and App Marketplace integrations. You will assess SOC 2 and penetration-test materials, verify data handling, and ensure compliance with Clio’s privacy requirements, escalating risks as needed.

You will triage privacy reviews, route sensitive data to DPIAs, and maintain the risk registry while collaborating with Privacy, Legal, IT, and Procurement.

Qualifications

• Hands-on experience in security, compliance, GRC, vendor risk, or procurement review roles.
• Familiarity with third-party audit artifacts. Ability to read SOC 2 reports and extract insights.
• Understanding core security/privacy concepts like access controls, encryption, data residency.
• Clear, evidence-first written communication; able to escalate when needed.

Responsibilities

• Review vendor security documentation including SOC 2, pen test summaries, and AI disclosures.
• Evaluate App Marketplace integration submissions for security/privacy risk.
• Identify processing of sensitive data and route to DPIA with Privacy/Compliance.
• Escalate risks and document findings for audit-ready rationale.
• Track submissions and move reviews through the workflow with stakeholders.
• Maintain the third-party risk registry and support renewals.

Skills

Security concepts

Data privacy

SOC 2

Documentation review

Communication

Tools

GRC tooling

Job description

Clio is seeking a Third-Party Risk Analyst to manage security reviews of vendor relationships and App Marketplace integrations. You will assess SOC 2 and penetration-test materials, verify data handling, and ensure compliance with Clio’s privacy requirements, escalating risks as needed.

You will triage privacy reviews, route sensitive data to DPIAs, and maintain the risk registry while collaborating with Privacy, Legal, IT, and Procurement.