Third Party Security Risk Management Specialist

Socket.dev; Toronto; Hybrid; CAD 85,000 - 125,000; Full time

Benefits offered by this job

Health benefits

Life insurance

Employer match savings

Vacation days

Wellness days

Unlimited sick days

Work abroad (90 days)

Employee resource groups

Job summary

Wealthsimple is expanding its Security Assurance team to strengthen third-party risk management and vendor oversight. You will lead risk assessments, design onboarding/offboarding, and drive the lifecycle of vendor risk programs in a regulated fintech environment.

You will work with Security, Legal, Procurement, Product, and Engineering to ensure due diligence and ongoing monitoring of vendor ecosystems. Strong analytical and communication skills are essential.

Qualifications

• 4-6 years of experience in third-party risk management, vendor risk assessment, or supply chain security.
• Knowledge of Canadian regulatory requirements (PIPEDA, OSFI) and international frameworks (SOC 2, ISO 27001).
• Ability to design and implement vendor risk management programs in regulated environments.
• Strong analytical and communication skills to present findings to stakeholders at all levels.
• Experience with risk assessment methodologies, vendor questionnaires, and due diligence processes.
• Familiarity with security frameworks and controls assessment; experience with GRC tools is a plus.
• Self-directed and able to manage multiple vendor assessments and influence cross-functional stakeholders.
• Certifications preferred (CTPRP, CISA, CISSP, CRISC or equivalent).

Responsibilities

• Lead the development and implementation of a scalable third-party risk management program.
• Conduct comprehensive security risk assessments of vendors, suppliers, and business partners.
• Collaborate with cross-functional teams to establish vendor onboarding/offboarding processes and risk rating methodologies.
• Develop policies for vendor lifecycle management from due diligence through ongoing monitoring and renewal.
• Drive continuous monitoring through risk-based assessments, vendor audits, and remediation tracking.
• Support procurement and legal with contract reviews ensuring security and compliance clauses.
• Contribute to incident response procedures related to third-party security events.
• Build and maintain a centralized vendor risk registry and reporting dashboard.

Skills

Vendor risk assessment

Third-party risk management

Supply chain security

Contract security reviews

Security questionnaires

Risk rating methodologies

Stakeholder communication

GRC tools

Vendor onboarding

Vendor offboarding

CTPRP

CISA

CISSP

CRISC

Education

Certifications in risk management

Tools

GRC tools

Job description

Build something people love

Wealthsimple is Canada’s leading financial innovator. The company offers a full suite of simple, sophisticated financial products across managed investing, do-it-yourself trading, cryptocurrency, tax filing, spending and saving. Wealthsimple currently serves more than 4 million Canadians and holds over $155 billion in assets under administration. The company was founded in 2014 by a team of financial experts and technology entrepreneurs, and is headquartered in Toronto, Canada.

We're proud of what we've built — and we're just getting started. Read our Culture Manual and learn more about how we work.

About the Security Assurance Team

The Security Assurance team plays a critical role in adhering to security frameworks and creating space for risk mitigation and oversight. We want to ensure that Wealthsimple maintains a secure operational environment by implementing and monitoring controls designed to protect information, systems and infrastructure.

About the Third Party Risk Management Specialist Role:

We aim to expand the Security Assurance team to strengthen our third-party risk management capabilities and enhance our vendor oversight program.

We are looking for a Third Party Risk Management Specialist with experience in vendor risk assessment, contract security reviews, and supply chain risk management. This role will be instrumental in operationalizing a comprehensive third-party risk management practice that aims to protect Wealthsimple and our clients while enabling business growth. You'll work closely with teams across Security, Legal, Procurement, Product, and Engineering to ensure proper due diligence and ongoing monitoring of our vendor ecosystem.

In this role, you'll have the opportunity to:

• Lead the development and implementation of a scalable third-party risk management program that aligns with business objectives and regulatory requirements

• Conduct comprehensive security risk assessments of vendors, suppliers, and business partners

• Collaborate with cross-functional teams to establish vendor onboarding/offboarding processes, security questionnaires, and risk rating methodologies

• Develop policies and procedures for vendor lifecycle management, from initial due diligence through ongoing monitoring and contract renewal

• Drive continuous monitoring initiatives through risk-based assessments, vendor audits, and remediation tracking

• Support procurement and legal teams with contract reviews, ensuring appropriate security and compliance clauses are included

• Contribute to incident response procedures related to third-party security events and vendor-related risks

• Build and maintain a centralized vendor risk registry and reporting dashboard for executive reporting

What you'll bring:

• 4-6 years of experience in third-party risk management, vendor risk assessment, or supply chain security (preferably in financial services or fintech)

• Working knowledge of Canadian regulatory requirements (PIPEDA, OSFI guidelines) and international frameworks (SOC 2, ISO 27001) with experience evaluating vendor compliance

• Proven ability to design and implement vendor risk management programs in complex, regulated environments

• Strong analytical and communication skills with ability to present risk findings and recommendations to stakeholders at all levels

• Experience with risk assessment methodologies, vendor questionnaires, and due diligence processes

• Familiarity with security frameworks and controls assessment (experience with GRC tools is a plus but not required)

• Self-directed professional who can manage multiple vendor assessments simultaneously and influence cross-functional stakeholders

• Relevant certifications preferred (CTPRP, CISA, CISSP, CRISC, or equivalent risk management credentials)

Why Wealthsimple?

Top-tier health benefits and life insurance

Long-term group savings with employer match, through Wealthsimple for Business

20 vacation days, 4 wellness days, and unlimited sick and mental health days per year

90 days away: work outside Canada for up to 90 days per year

Employee resource groups, including Rainbow (2SLGBTQ), Women of WS, and Black at WS

We are a hybrid team with over 1,500 employees across North America. The people are one of the best parts of working here: you'll collaborate with incredibly talented, curious, and driven teammates who are deeply committed to doing great work.

ICYMI

Technology & Innovation at Wealthsimple:

We move quickly and build thoughtfully. That means we're always looking for better ways to work — whether that's new tools, AI, or rethinking how we approach a problem. We don't expect you to have all the answers, but we do expect curiosity and a willingness to evolve alongside the products we're building.

Inclusion Statement:

We're building products for a diverse world, and we need a diverse team to do it well. We strongly encourage applications from everyone, regardless of race, religion, colour, national origin, gender, sexual orientation, age, marital status, or disability status.

Accessibility Statement:

We're committed to an accessible hiring experience. If you need any accommodations throughout the interview process, please let us know — we'll work with you to make sure you have what you need. We also welcome any feedback on how we can better accommodate candidates with accessibility needs.

AI in Hiring:

We may use artificial intelligence (AI) tools to support parts of our hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our team but don't replace human judgment – all final hiring decisions are made by people. If you have questions about how your data is used, reach out to us.