Third-Party Risk Analyst - Security & Vendor Vetting

clio; Vancouver; On-site; CAD 80,000 - 110,000; Full time

Job summary

Clio is seeking a Third-Party Risk Analyst to own the day-to-day security review of vendors and App Marketplace partners, reading SOC 2 and penetration test reports and assessing privacy disclosures.

You will triage DPIAs, escalate risks, track submissions, and maintain the third-party risk registry while collaborating with Privacy, Legal and IT teams.

Experience with audit artifacts, data residency concepts, and a detail‑driven, evidence‑first approach will help you succeed.

Qualifications

• 2–4 years of hands-on experience in security, compliance, or vendor risk.
• Familiarity with third-party audit artifacts (SOC 2, ISO 27001, PCI/DSS).
• Ability to review documentation critically and identify real risks.

Responsibilities

• Review vendor security documentation and determine if standards are met.
• Evaluate App Marketplace submissions for security and privacy.
• Triage for privacy review and route to DPIA when needed.
• Escalate risks and document rationale for stakeholder decisions.
• Track submissions and move reviews through the workflow.

Skills

Security

GRC

Vendor risk

Procurement

Tools

SOC 2 reports

Privacy controls

Job description

Clio is seeking a Third-Party Risk Analyst to own the day-to-day security review of vendors and App Marketplace partners, reading SOC 2 and penetration test reports and assessing privacy disclosures.

You will triage DPIAs, escalate risks, track submissions, and maintain the third-party risk registry while collaborating with Privacy, Legal and IT teams.

Experience with audit artifacts, data residency concepts, and a detail‑driven, evidence‑first approach will help you succeed.