Third Party Risk & Governance Analyst

OnX; Toronto; Hybrid; CAD 70,000 - 100,000; Full time

Job summary

OnX in Toronto is seeking a Third-Party Risk & Governance Analyst to join the Procurement/Vendor Management team. You will lead TPRM assessments across onboarding, renewals, and offboarding, partnering with Privacy, Security, Legal, Compliance, and vendors to mitigate third-party risks.

The role is hybrid (2 days in-office in downtown Toronto) on a six-month contract with potential extension or full-time conversion. 3–5 years in TPRM or related fields is expected.

Qualifications

• 3-5 years of experience in Third-Party Risk Management, Vendor Risk Management, Governance, Compliance, Procurement, or Operational Risk.
• Experience managing vendor due diligence, risk assessments, ongoing monitoring, and remediation activities.
• Strong stakeholder management skills and the ability to collaborate across business, risk, and vendor teams.
• Strong analytical, organizational, and communication skills.
• Experience supporting technology, SaaS, cloud, or managed service providers is an asset.

Responsibilities

• Lead and coordinate TPRM assessments for vendor onboarding, renewals, ongoing monitoring, and offboarding.
• Partner with Business Owners, Privacy, Security, Legal, Compliance, Procurement, and vendors to identify, assess, and mitigate third-party risks.
• Manage vendor criticality assessments, due diligence reviews, risk remediation plans, and risk exceptions.
• Monitor supplier performance through scorecards, metrics, and Quarterly Business Reviews (QBRs) for strategic suppliers.
• Track and manage incidents, issues, corrective action plans, concentration risk, and ongoing risk mitigation activities.
• Develop and maintain Exit Plans and Business Continuity Plans based on vendor criticality and risk tier.
• Maintain the TPRM Inventory and ensure vendor risk records, due diligence documentation, and governance activities remain current.
• Support audits, regulatory requirements, and adherence to TPRM Policy.

Skills

Third-Party Risk Management

Vendor Risk Management

Governance

Compliance

Procurement

Operational Risk

Job description

One of Client is looking to add a Third Party Risk & Governance Analyst to their team.

This person will sit within the Procurement/Vendor Management department and will help do Third-Party risk assessments and govern vendors. This is not a role specific to Technology - they will engage with all types of vendors.

Its a hybrid role 2 days a week in office (Tuesday, Wednesday), downtown Toronto. Its a 6 months contract to start with a potential to extend or convert into a full time role.

Responsibilities:

• Lead and coordinate TPRM assessments for vendor onboarding, renewals, ongoing monitoring, and offboarding
• Partner with Business Owners, Privacy, Security, Legal, Compliance, Procurement, and vendors to identify, assess, and mitigate third-party risks
• Manage vendor criticality assessments, due diligence reviews, risk remediation plans, and risk exceptions
• Monitor supplier performance through scorecards, metrics, and Quarterly Business Reviews (QBRs) for strategic suppliers
• Track and manage incidents, issues, corrective action plans, concentration risk, and ongoing risk mitigation activities
• Develop and maintain Exit Plans and Business Continuity Plans based on vendor criticality and risk tier
• Maintain the TPRM Inventory and ensure vendor risk records, due diligence documentation, and governance activities remain current
• Support audits, regulatory requirements, and adherence to TPRM Policy

Mandatory Skills:

• 3-5 years of experience in Third-Party Risk Management, Vendor Risk Management, Governance, Compliance, Procurement, or Operational Risk
• Experience managing vendor due diligence, risk assessments, ongoing monitoring, and remediation activities
• Strong stakeholder management skills and the ability to collaborate across business, risk, and vendor teams
• Strong analytical, organizational, and communication skills
• Experience supporting technology, SaaS, cloud, or managed service providers is an asset

Nice to Have:

• Experience supporting financial services, insurance, healthcare, or other regulated environments.
• Understanding of OSFI B-10, third-party risk management principles, operational resilience, or enterprise risk management frameworks.
• Experience facilitating QBRs, vendor scorecards, and performance monitoring programs.
• Exposure to SaaS, cloud, managed services, and technology supplier ecosystems.