Senior Cyber Risk Analyst - Third-Party Security

BeachHead Inc.; Toronto; On-site; CAD 92,000 - 110,000; Full time

Job summary

BeachHead Inc. is seeking a CyberSecurity Risk Analyst to evaluate supplier security controls, negotiate security obligations, and support third-party risk frameworks within the procurement team.

The role involves working with a top financial client to strengthen risk posture across procurement activities. The position focuses on translating security requirements into contractual strategies and supporting risk mitigation in a dynamic banking environment, including cloud, SaaS, and outsourcing

Qualifications

• 10+ years of experience in information security, cybersecurity, technology risk, or a closely related discipline.
• 8+ years assessing supplier security controls, including cloud, SaaS, and outsourcing.
• Working knowledge of security frameworks such as NIST, ISO/IEC 27001/27002, and SOC 1/SOC 2.
• Experience interpreting contractual security language and negotiating exceptions.
• Ability to communicate complex technical issues in clear business language.

Responsibilities

• Review supplier redlines, exceptions, proposed substitutions, and qualification language affecting security obligations.
• Assess whether alternative controls provide comparable protection, considering the supplier’s services, delivery model, and risk profile.
• Translate technical security requirements into clear contractual and negotiation strategies for Procurement.
• Support sourcing and contract managers in supplier discussions, explaining requirements and documenting rationales.
• Identify contractual changes that may weaken security obligations and differentiate routine drafting from substantive control or risk alterations.
• Apply knowledge of security policies, third-party risk frameworks, and applicable regulatory requirements to advise on supplier risk.
• Consider supplier access to information, systems, environments, and services, including cloud, SaaS, and outsourcing.
• Support alignment between security requirements and risk assessments, control evaluations, and contractual obligations.
• Act as Procurement’s primary point of contact for supplier security-related inquiries, coordinating with Security, Legal, and Technology Risk teams.
• Resolve issues within delegated authority; escalation deviations and risk acceptance decisions as needed.
• Prepare decision papers that outline proposed changes, risks, options, and recommendations.
• Maintain an audit trail of advice, approvals, and negotiated positions.
• Assist in maintaining security contracting playbooks, clause guidance, and negotiation templates.
• Identify common supplier objections and recommend improvements to standard clauses and processes.
• Provide training to sourcing teams on security clause interpretation and escalation procedures.

Skills

Security leadership

Risk assessment

Contract interpretation

Communication

CLM

MS Office

Tools

MS Office Suite

Job description

BeachHead Inc. is seeking a CyberSecurity Risk Analyst to evaluate supplier security controls, negotiate security obligations, and support third-party risk frameworks within the procurement team.

The role involves working with a top financial client to strengthen risk posture across procurement activities. The position focuses on translating security requirements into contractual strategies and supporting risk mitigation in a dynamic banking environment, including cloud, SaaS, and outsourcing