Senior Analyst, Enterprise Risk Management (GRC Tool Implementation & Third-Party Risk Focus)

tmx; Toronto; On-site; CAD 90,000 - 120,000; Full time

Job summary

TMX seeks a Senior Analyst, Enterprise Risk Management to support the delivery of ERM and Operational Resilience programs across CDCC and CDS. The role focuses on deploying a new GRC platform, automating risk monitoring workflows, and advancing the Third-Party Risk Management program through independent second-line support for vendor assessments.

The position reports to the Manager, ERM & Non-Financial Resilience and offers a hybrid work model with 2-3 days in office in Toronto or Montreal.

Responsibilities

• Governance, Risk, Compliance (GRC) Tool Implementation — design, deploy, and automate risk workflows.
• Third Party Risk Management (TPRM) governance framework support across CDCC and CDS, including due diligence and risk profiling.
• Regulatory Initiatives & Reviews — assist in regulatory inquiries, align with best practices and evolving standards.
• Incident Reporting — support end-to-end incident tracking and root cause analyses with action plans.
• Collaborate across ERM programs to support ORM and other risk initiatives.

Job description

Venture outside the ordinary - TMX Careers

The TMX group of companies includes leading global exchanges such as the Toronto Stock Exchange, Montreal Exchange, and numerous innovative organizations enhancing capital markets. United as a global team, we're connecting cross-functionally, traversing industries and geographies, moving opportunity into action, advancing global economic growth, and propelling progress. Through a rich exchange of ideas, meaningful collaboration, and a nimble operating model, we're powering some of the nation's most critical systems, fueling capital formation and innovation, bringing increased opportunity to business visionaries, product ingenuity to consumers, and career exploration to our team.

Ready to be part of the action?

Join a pivotal second-line position at the heart of Canada's financial market infrastructure. As a Senior Analyst, Enterprise Risk Management , you will support the delivery of the Enterprise Risk Management (ERM) and Operational Resilience programs across the Canadian Depository for Securities (CDS)-Canada's central securities depository, clearing, and settlement hub-and the Canadian Derivatives Clearing Corporation (CDCC)-the national central counterparty for exchange-traded and over-the-counter derivatives-collectively known as "TMX Post-Trade."

You will play a key role in spearheading the deployment and adoption of a new Governance, Risk, and Compliance (GRC) platform designed to automate and elevate complex risk monitoring workflows. This role carries a primary focus on driving digital transformation by transitioning manual frameworks into seamless automated systems, alongside advancing Post-Trade's Third-Party Risk Management (TPRM) program by providing independent second-line support for vendor risk assessments.

This role reports to: Manager, Enterprise Risk Management & Non-Financial Resilience

Job Location: Hybrid (2-3 days in office) - we are open to candidates being located in one of our Canadian office locations: Toronto or Montreal.

Key Responsibilities

• Governance, Risk, Compliance (GRC) Tool Implementation

  Carry out the design, configuration, deployment, and application of Governance, Risk, Compliance (GRC) Tool to automate and optimize Third Party risk monitoring, assessments, and reporting workflows.

  Partner with the GRC tool vendor and internal IT teams to transition manual risk management processes into automated workflows, ensuring the system's design aligns seamlessly with TMX Post-Trade's ERM governance.

  Support change management efforts for system rollouts by developing comprehensive user guides and delivering training to Business Units on the newly automated processes.

  Continuously identify opportunities to streamline existing risk management processes through workflow automation, data integration, and system enhancements.

• Third Party Risk Management (TPRM)

  Support the Manager, ERM in developing and maintaining the TPRM governance framework, ensuring alignment with CDCC and CDS risk appetite.

  Support the efficient and effective implementation of the TPRM program across CDCC and CDS, including performing materiality assessment and risk-based due diligence on vendors onboarded as part of new business initiatives and BAU.

  Provide guidance and training to Business Units on the requirements and responsibilities included in the TPRM governance.

  Contribute to the preparation and delivery of the quarterly reporting process on the third-party risk profile.

  Support the Manager, ERM in driving continuous improvement of Post-Trade's TPRM program by analyzing industry trends and benchmarking against evolving global regulations (i.e. DORA), operational resilience and regulatory compliance.

• Regulatory Initiatives & Reviews

  Support the Manager, ERM in addressing non-financial risk regulatory inquiries related to regulatory initiatives and reviews.

  Support the Manager, ERM in developing and implementing emerging best practices that align with both regulatory requirements and broader industry standards.

  Support the Manager, ERM in monitoring and analyzing internal and external environments to identify emerging risks that may impact TMX Post-Trade's strategic objectives and risk profile, and report to senior management.

• Incident Reporting

  Facilitate the end-to-end incident reporting process, ensuring risk events are accurately documented, tracked, and escalated in a timely manner.

  Support root cause analyses of identified incidents and partnering with business units to track the implementation of corrective action plans.

• Collaborative Opportunities Across Enterprise Risk Management Programs:

  While the primary focus is on New GRC Tool Implementation and Third Party Risk Management (TPRM), there may be opportunities to contribute in a supportive role to initiatives within:

  • Operational Risk Management (ORM): Support risk assessment and oversight for operational activities. Monitor key risk indicators, and analyze operational risk data to identify