Risk Analyst

Global-Technical-Talent-1; Toronto; Hybrid; CAD 83,000 - 96,000; Part time

Job summary

Global-Technical-Talent-1 is seeking a Risk Analyst in Toronto, ON on a 10-month contract with hybrid work (4 days on-site, 1 day remote). The role sits in Enterprise Procurement and concentrates on supplier risk and security within a team of about 80 people.

Onboarding and knowledge transfer precede active work. The contractor will engage stakeholders across Procurement, Security, Legal and Technology Risk, with roughly six hours of meetings per day, and will review security obligations, assess

Qualifications

• 10+ years of experience in information security, cybersecurity, technology risk, or related field.
• 8+ years of experience assessing supplier security controls and third-party technology risks.
• Working knowledge of NIST, ISO/IEC 27001/27002 and SOC 1/SOC 2 reports.
• Experience interpreting contractual security language and negotiating supplier exceptions.
• Ability to communicate technical issues in clear business terms and document decisions.
• Strong knowledge of Contract Lifecycle Management (CLM).
• Strong knowledge of MS Office Suite.

Responsibilities

• Review supplier redlines, exceptions and proposed substitutions affecting security obligations.
• Assess whether proposed controls provide adequate protection given services, data access, hosting and risk profile.
• Translate security requirements into contractual implications and negotiation recommendations for Procurement.
• Support sourcing and contract managers in supplier discussions and document rationale.

Skills

Strong communication skills

Strong presentation skills

Ability to train procurement teams

Education

Diploma or Bachelor's degree

Tools

MS Office Suite

Job description

Risk Analyst

Location: Toronto, ON

Onsite Flexibility

Hybrid — 4 days on-site, 1 day work from home

Contract Details

• Position Type: Contract
• Contract Duration: 10 months (with possibility of extension and conversion based on business needs and performance)
• Pay Rate: C$60.00–C$70.00 / Hour (CAD)
• Shift / Schedule: Monday–Friday, core business hours, 37.5 hours per week, 7.5 hours per day
• Travel Requirements: Not required

Job Summary

This Risk Analyst role sits within Enterprise Procurement and focuses on supplier risk and security. The position is net new and will operate within a team of approximately 80 people. The successful contractor will undergo TD onboarding and a knowledge-transfer period before hitting the ground running. The role involves significant stakeholder engagement — approximately six hours per day in meetings on average — coordinating internally across Procurement, Security, Legal, and Technology Risk. The contractor will not have access to any customer data.

Key Responsibilities

A. Supplier Security Schedule Review and Negotiation

• Review supplier redlines, exceptions, proposed substitutions and qualification language affecting security obligations.
• Assess whether proposed alternative controls provide comparable protection, taking account of the supplier's services, delivery model, data access, hosting arrangements and risk profile.
• Translate technical security requirements into clear contractual implications and practical negotiation recommendations for Procurement.
• Support sourcing and contract managers in supplier discussions, including explaining requirements, documenting rationale and proposing acceptable wording within approved positions.
• Identify changes that weaken, qualify, narrow or remove security obligations and distinguish routine drafting issues from substantive control or risk changes.

B. Financial Services and Third-Party Risk Advisory

• Apply knowledge of the organization's security policies, third-party risk framework and applicable financial-services regulatory expectations, including relevant OSFI requirements, as directed by internal control owners.
• Consider supplier access to information, systems, environments and services, including cloud, SaaS, outsourcing and other technology-enabled arrangements.
• Identify when a supplier proposal may affect incident notification, audit and assurance, access controls, data protection, subcontracting, resilience, business continuity or termination/exit obligations.
• Support alignment between contractual security requirements and the supplier risk assessment and control-assessment process.

C. Stakeholder Coordination and Escalation

• Act as Procurement's primary point of contact for supplier security-contracting questions and coordinate input from Security, Legal and Technology Risk.
• Resolve matters that fall within approved playbooks and delegated authority; elevate material deviations, policy exceptions and risk acceptance decisions to the designated owners.
• Prepare concise decision papers identifying the proposed change, relevant standard, risk implication, options, recommendation and required approver.
• Maintain an audit trail of advice, approvals, deviations and final negotiated positions.

D. Playbooks and Process

• Help maintain security-contracting playbooks, clause guidance, fallback language, negotiation matrices and escalation thresholds.
• Identify recurring supplier objections and recommend improvements to standard clauses, guidance and sourcing processes.
• Provide training and practical guidance to sourcing managers and contract managers on security clause interpretation and escalation procedures.

Initial Contracting Scope

The position would initially focus on supplier amendments to the following provisions identified for this business case. The advisor should validate clause-specific requirements against the current approved agreement templates, standards and playbooks before providing negotiation advice.

Security Controls

• Review supplier redlines to detailed security controls, including proposed alternative controls, qualifications, exclusions and requests to reduce or remove obligations. Assess contractual and control implications and recommend positions consistent with approved security requirements.

Public Cloud Provider

• Review supplier changes relating to public-cloud delivery and associated security obligations. Coordinate assessment of cloud-specific concerns and identify changes requiring input or approval from Security, Technology Risk, Legal or other control owners.

Security

• Review changes to overarching security obligations and their interaction with the security schedules and related contractual provisions. Identify potential impacts on incident handling, compliance with security requirements and consistency across the agreement.

Must-Have Requirements

• 10 years of experience within information security, cybersecurity, technology risk, third-party/vendor risk, or a closely related discipline
• 8 years of experience assessing supplier security controls and third-party technology risks, including cloud, SaaS, outsourcing or managed services
• Working knowledge of security and assurance frameworks such as NIST, ISO/IEC 27001/27002 and SOC 1/SOC 2 reports
• Experience interpreting contractual security language, negotiating supplier exceptions, and working with Procurement, Legal and Security stakeholders
• Ability to communicate technical issues in clear business and contractual terms, document decisions and manage multiple negotiations
• Strong knowledge of Contract Lifecycle Management (CLM)
• Strong knowledge of MS Office Suite

Required Skills

• Strong communication skills (written and verbal)
• Strong presentation skills
• Ability to train procurement teams, provide knowledge transfers, etc.

Preferred Skills

• Banking or financial institution experience
• Relevant certifications such as CISSP, CISM, CISA or CRISC would be considered assets; equivalent practical experience should also be recognized

Education Requirements

• Diploma or Bachelor's degree is required

Required Experience

• 10 years of overall experience in a related field

Important Notes

• Interview process: 2 steps, virtual, 30 minutes, panel

About the Client

This client is a leading financial services and banking institution operating across Canada and internationally, with a team culture that emphasizes collaboration, agility, and continuous growth. The organization employs thousands of professionals across risk, procurement, technology, legal, and compliance functions, offering contractors meaningful exposure to enterprise-scale supplier risk and security programs. The bank is known for its strong work culture and multiple ongoing transformation initiatives that present significant opportunities for learning and career development.

#LI-Hybrid #LI-GTT #gttca