Third-Party Risk Analyst

Clio; Burnaby; Hybrid; CAD 90,000 - 120,000; Full time

Benefits offered by this job

Hybrid work model

Learning & development

Pay transparency

Equity

Job summary

Clio is seeking a Third-Party Risk Analyst to own the security review of vendor relationships and App Marketplace partnerships. You will read SOC 2 reports, penetration test summaries, and privacy disclosures, advise on risk, and drive reviews through a structured process with IT, Legal, and Privacy teams.

You will escalate real risks, maintain the risk registry, and support renewals, ensuring customer data and brand protection through rigorous documentation and cross-functional collaboration.

Qualifications

• Strong organizational skills and attention to detail.
• Understanding of core security and privacy concepts.
• 2-4 years in security/compliance or vendor risk roles.
• Familiarity with third-party audit artifacts and SOC 2 reports.

Responsibilities

• Review vendor security documentation (SOC 2, pen tests, etc.) and assess privacy compliance.
• Evaluate App Marketplace integration security and privacy submissions.
• Escalate risks and document rationale for stakeholders.
• Maintain the third-party risk registry and support renewals.

Skills

Organizational skills

Security concepts

Privacy concepts

GRC

Vendor risk

SOC 2 familiarity

Audit artifacts

Documentation review

Written communication

Critical thinking

Independent problem solving

GDPR/CCPA awareness

Tools

Vendor management tooling

Job description

• Third-Party Risk Management (TPRM) is responsible for making sure the outside parties Clio relies on, including software vendors, service providers, and platform integrators it lists in the App Marketplace, meet Clio's bar for security and privacy before they touch Clio or customer data


• We sit inside the vendor lifecycle as the security compliance review phase of Procurement, after intake and in parallel with Legal and IT. We work closely with IT, Privacy, Legal, and the App Ecosystem team to deliver strong, documented, defensible assessments of security posture and risk


• As a Third-Party Risk Analyst, you are the person who reads the security documentation and advises on the risk of third-party relationships. You own the day-to-day execution of the security review phase, working through vendor submissions, reviewing SOC 2 and penetration test reports, checking data handling against our requirements, and reviewing the security and privacy submissions of partners applying to list in Clio's App Marketplace


• When the third party’s criticality is higher, you step up the documentation criteria and adapt. You apply an established set of criteria commensurate with the service provided, surface real risk from paperwork, and keep reviews moving


• You don’t need to have seen every framework or every control, but you need to know what a good answer looks like, what questions to ask when something’s missing, and when to elevate rather than wave something through


• Review vendor security documentation submitted through the intake process, including SOC 2 reports, penetration test summaries, security whitepapers, AI disclosures, and questionnaire responses, and determine whether the vendor meets Clio's required level of security and privacy


• Review App Marketplace integration submissions and evaluate the security and privacy documentation of integration partners applying to list on Clio. Flag exceptions that could put customer data or Clio's brand at risk before a partner is added to the marketplace


• Triage for privacy review by identifying when a vendor or integration will process confidential or sensitive data and route it into a Data Privacy Impact Assessment (DPIA), partnering with Privacy/Compliance


• Escalate for risk acceptance when a risk is identified in the review process. Document and present it to the appropriate stakeholder for decision making


• Move reviews through the workflow by tracking submissions, requesting missing artifacts from requesters and vendors, responding to comments, and handing off cleanly to IT, Legal, and executive sign-off


• Document your findings and decisions. Record what you reviewed, what you found, the risks identified, and your recommendation so the rationale is reusable and audit-ready


• Maintain the third-party risk registry


• Support renewals and reassessments by re-reviewing vendors on renewal or change of scope


• Keep the review criteria and runbooks accurate. Follow the established process and flag when a checklist, threshold, or template is out of date or unclear

Benefits

• Specialized learning and development programs and access to an in-house performance coach


• Equitable compensation for your contributions, regardless of gender, race, or any other identifying factor


• Access to pay transparency on all of our global roles


• Company equity for applicable employees


• RRSP-matching in Canada, 401k in the US, and pension plans in Ireland


• Hybrid model - striking the right balance between the benefits of in person connectivity that in office brings, and the flexibility of remote


• Flexible paid time off (4-week minimum with opportunities for personalization based on individual needs and achievements)


• Parental leave options for birthing and non-birthing parents


• A $500 contribution to your child's RESP


• Various health, dental, and vision benefits for you and your family, including an Employee and Family Assistance Program


• Virtual and In-person Wellness Programs to support mental and physical health


• Paid time for volunteering through our Clio Gives program


• $2000 annual counseling benefit for CAD Clions

Strong organizational skills. You keep multiple reviews moving without losing track of what's waiting on whomUnderstanding of core security and privacy concepts, including access controls, encryption, data classification, data residency, and what different tiers of security and privacy documentation look like2-4 years of hands-on experience in a security, compliance, GRC, vendor risk, or procurement review roleWorking familiarity with third-party audit artifacts. You've read SOC 2 reports and know how to review them and extract a deeper understandingComfort working within an established review process and contributing to its improvementClear, evidence-first written communicationDemonstrated ability to review documentation critically and separate real risk from noiseKnows when to figure something out independently and when to pull in a subject matter expertYou take full ownership of your review queue, communicate effectively, and are able to balance competing prioritiesYou have an intuition for looking beyond the presented facts and noticing emerging patterns across artifactsYou're curious about why a control matters, not just whether a box is checkedYour curiosity drives you to learn the why behind the answers, questions, and processesYou have the judgment to hold the line on a real risk and the pragmatism to keep low-risk reviews movingYou communicate clearly when documentation is missing, when a risk needs escalation, or when you need help. Nothing gets quietly approvedYou're energized by helping build and sharpen a review function rather than inheriting a finished onePrevious experience with GRC, TPRM, or vendor management toolingYou are able to see the gaps in documentation and suggest compensating controls where applicableExposure to SOC 2, ISO 27001, PCI DSS, or GDPR/CCPA concepts in an audit contextExperience with GDPR, CCPA, DPIAs and/or privacy impact assessmentsCISA, CIPP/CIPM, CTPRP, CompTIA Security+, or equivalent certification