Risk Analyst V - Toronto

Randstad Canada; Toronto; Híbrido; CAD 120.000 - 160.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Hybrid work model

Cross-functional exposure

Descripción de la vacante

Randstad Canada is seeking an experienced Risk Analyst V (Supplier Security & Third-Party Risk Advisory Specialist) to join the enterprise technology risk and procurement advisory group in a hybrid capacity.

You will bridge Procurement, Legal, Cybersecurity, and Technology Risk to review supplier contracts, draft fallback language, and align security provisions with internal risk controls and OSFI-like expectations.

Formación

• 10+ years in information security or risk management.
• 8+ years assessing supplier security and third-party risks.
• Knowledge of NIST, ISO/IEC 27001/27002, SOC 1/2.
• Experience interpreting contractual security language and negotiating.
• Experience with CLM platforms and MS Office.

Responsabilidades

• Review supplier redlines and assessed risks across cloud, SaaS, and tech-enabled arrangements.
• Collaborate with sourcing managers and legal, explaining security requirements and fallback language.
• Apply enterprise security frameworks to supplier agreements and regulatory expectations.
• Identify clause changes affecting incident notification, audits, access controls, data protection, subcontracting, exits.
• Prepare concise decision papers and maintain audit trails of approvals and positions.
• Maintain security-contracting playbooks and train procurement teams on security clauses.

Conocimientos

Information Security & Risk depth

Supplier & Cloud Risk Assessment

Security Framework Knowledge

Contract Language & Negotiation

CLM & Tools Proficiency

Communication & Training Abilities

Herramientas

CLM platforms

Microsoft Office Suite

Descripción del empleo

Our client, is seeking an experienced, highly detail-oriented Risk Analyst V (Supplier Security & Third-Party Risk Advisory Specialist) to join their enterprise technology risk and procurement advisory group. In this strategic, high-visibility role, you will act as the primary point of contact for supplier security contracting questions and third-party risk assessments. Working in a hybrid capacity, you will review supplier redlines, assess alternative controls, and translate technical cybersecurity requirements into clear contractual positions and negotiation guidelines for Procurement and Legal teams. You will evaluate supplier risks across cloud, SaaS, and managed service environments, aligning contractual security provisions with internal risk control frameworks and applicable financial services regulatory expectations (such as OSFI standards). Duration: 10-Month Contract (Full-time engagement). Work Arrangement: Hybrid (4 days per week on-site at corporate offices; 1 day work from home; flexible anchor days).

Advantages

• High-Visibility Strategic Scope: Serve as the core bridge between Procurement, Legal, Cybersecurity, and Technology Risk teams on major enterprise vendor contracts.
• Complex Risk Negotiations: Drive high-value contract redlines, evaluating security provisions, incident response triggers, and data protection clauses for public cloud and SaaS integrations.
• Enterprise Governance Impact: Maintain and optimize security-contracting playbooks, negotiation matrices, and fallback clause guidance across the organization.
• Balanced Hybrid Model: Enjoy workplace flexibility with a 4-day on-site and 1-day remote work schedule.

Responsibilities

• Supplier Security Schedule Review & Negotiation: Review supplier redlines, exceptions, and proposed alternative controls affecting security obligations, evaluating risks across cloud, SaaS, and technology-enabled arrangements.
• Procurement & Legal Collaboration: Partner directly with sourcing managers and legal teams during supplier discussions, explaining technical security requirements, documenting rationale, and proposing acceptable fallback language.
• Third-Party Risk Advisory & Regulatory Alignment: Apply knowledge of enterprise security frameworks, third-party risk management policies, and financial services regulatory expectations (including OSFI guidelines) to supplier agreements.
• Contractual Impact Assessment: Identify clause changes affecting incident notification timelines, audit/assurance rights, access controls, data protection, subcontracting, and termination/exit obligations.
• Stakeholder Escalation & Decision Papers: Prepare concise decision papers for leadership summarizing proposed changes, risk implications, and recommendations; maintain complete audit trails of approvals and negotiated positions.
• Playbook Governance & Enablement: Help maintain security-contracting playbooks and fallback clause guidance while training procurement and contract management teams on security clause interpretations.

Qualifications

• Information Security & Risk Depth: 10+ years of dedicated professional experience within information security, cybersecurity, technology risk, or third-party/vendor risk management (TPRM).
• Supplier & Cloud Risk Assessment: 8+ years of hands-on experience assessing supplier security controls and third-party technology risks (cloud, SaaS, outsourcing, managed services).
• Security Framework Knowledge: Deep working knowledge of security and assurance frameworks, including NIST, ISO/IEC 27001/27002, and SOC 1 / SOC 2 audit reports.
• Contract Language & Negotiation Experience: Proven track record interpreting complex contractual security language, negotiating supplier redlines, and partnering with Procurement and Legal teams.
• CLM & Tools Proficiency: Strong expertise working with Contract Lifecycle Management (CLM) platforms and Microsoft Office Suite.
• Communication & Training Abilities: Exceptional written and verbal communication skills, with a proven ability to present complex technical issues in clear business terms and deliver training to internal stakeholders.

Preferred Assets & Nice-to-Haves

• Experience working within a major bank, financial institution, or highly regulated corporate environment.
• Industry certifications such as CISSP, CISM, CISA, or CRISC (or equivalent practical experience).

Summary

If you are a tech-savvy Risk Analyst V who pairs 10+ years of information security and third-party risk management expertise with strong supplier contract negotiation skills, NIST/ISO framework knowledge, and Contract Lifecycle Management (CLM) experience, this 10-month hybrid contract opportunity is an ideal next step. Bring your risk advisory precision, contractual acumen, and collaborative drive to our team today!

Randstad Canada is committed to fostering a workforce reflective of all peoples of Canada. As a result, we are committed to developing and implementing strategies to increase the equity, diversity and inclusion within the workplace by examining our internal policies, practices, and systems throughout the entire lifecycle of our workforce, including its recruitment, retention and advancement for all employees. In addition to our deep commitment to respecting human rights, we are dedicated to positive actions to affect change to ensure everyone has full participation in the workforce free from any barriers, systemic or otherwise, especially equity-seeking groups who are usually underrepresented in Canada's workforce, including those who identify as women or non-binary/gender non-conforming; Indigenous or Aboriginal Peoples; persons with disabilities (visible or invisible) and; members of visible minorities, racialized groups and the LGBTQ2+ community.

This posting is for existing and upcoming vacancies.