Risk Analyst

Risk Analyst

Location: Toronto, ON

Onsite Flexibility: Hybrid — 4 days on-site, 1 day work from home

Contract Details

• Position Type: Contract
• Contract Duration: 10 months (with possibility of extension and conversion based on business needs and performance)
• Pay Rate: C$60.00–C$70.00 / Hour (CAD)
• Shift / Schedule: Monday–Friday, core business hours, 37.5 hours per week, 7.5 hours per day
• Travel Requirements: Not required

Job Summary

This is a net-new contract position focused onsupplier risk and security within Procurement at a leading Canadian financial institution. The successful candidate will join a team of approximately 80 people and will spend a significant portion of their time — averaging 6 hours per day — in internal meetings, coordinating exclusively with internal stakeholders. The contractor will not have access to any customer data. The onboarding process includes TD onboarding followed by knowledge transfer, with an expectation to hit the ground running. This role offers significant opportunity to learn and grow within a large financial institution undergoing multiple transformations.

Key Responsibilities

A. Supplier Security Schedule Review and Negotiation

• Review supplier redlines, exceptions, proposed substitutions and qualification language affecting security obligations.
• Assess whether proposed alternative controls provide comparable protection, taking account of the supplier's services, delivery model, data access, hosting arrangements and risk profile.
• Translate technical security requirements into clear contractual implications and practical negotiation recommendations for Procurement.
• Support sourcing and contract managers in supplier discussions, including explaining requirements, documenting rationale and proposing acceptable wording within approved positions.
• Identify changes that weaken, qualify, narrow or remove security obligations and distinguish routine drafting issues from substantive control or risk changes.

B. Financial Services and Third-Party Risk Advisory

• Apply knowledge of the organization's security policies, third-party risk framework and applicable financial-services regulatory expectations, including relevant OSFI requirements, as directed by internal control owners.
• Consider supplier access to information, systems, environments and services, including cloud, SaaS, outsourcing and other technology-enabled arrangements.
• Identify when a supplier proposal may affect incident notification, audit and assurance, access controls, data protection, subcontracting, resilience, business continuity or termination/exit obligations.
• Support alignment between contractual security requirements and the supplier risk assessment and control-assessment process.

C. Stakeholder Coordination and Escalation

• Act as Procurement's primary point of contact for supplier security-contracting questions and coordinate input from Security, Legal and Technology Risk.
• Resolve matters that fall within approved playbooks and delegated authority; escalate material deviations, policy exceptions and risk acceptance decisions to the designated owners.
• Prepare concise decision papers identifying the proposed change, relevant standard, risk implication, options, recommendation and required approver.
• Maintain an audit trail of advice, approvals, deviations and final negotiated positions.

D. Playbooks and Process

• Help maintain security-contracting playbooks, clause guidance, fallback language, negotiation matrices and escalation thresholds.
• Identify recurring supplier objections and recommend improvements to standard clauses, guidance and sourcing processes.
• Provide training and practical guidance to sourcing managers and contract managers on security clause interpretation and escalation procedures.

Initial Contracting Scope

The position would initially focus on supplier amendments to the following provisions identified for this business case. The advisor should validate clause-specific requirements against the current approved agreement templates, standards and playbooks before providing negotiation advice.

Security Controls

• Review supplier redlines to detailed security controls, including proposed alternative controls, qualifications, exclusions and requests to reduce or remove obligations. Assess contractual and control implications and recommend positions consistent with approved security requirements.

Public Cloud Provider

• Review supplier changes relating to public-cloud delivery and associated security obligations. Coordinate assessment of cloud-specific concerns and identify changes requiring input or approval from Security, Technology Risk, Legal or other control owners.

Security

• Review changes to overarching security obligations and their interaction with the security schedules and related contractual provisions. Identify potential impacts on incident handling, compliance with security requirements and consistency across the agreement.

Must-Have Requirements

• 10 years of experience within information security, cybersecurity, technology risk, third-party/vendor risk, or a closely related discipline
• 8 years of experience assessing supplier security controls and third-party technology risks, including cloud, SaaS, outsourcing or managed services
• Working knowledge of security and assurance frameworks such as NIST, ISO/IEC 27001/27002 and SOC 1/SOC 2 reports
• Experience interpreting contractual security language, negotiating supplier exceptions, and working with Procurement, Legal and Security stakeholders
• Ability to communicate technical issues in clear business and contractual terms, document decisions and manage multiple negotiations
• Strong knowledge of Contract Lifecycle Management (CLM)
• Strong knowledge of MS Office Suite

Required Skills

• Strong communication skills (written and verbal)
• Strong presentation skills
• Ability to train procurement teams, provide knowledge transfers, etc.

Preferred Skills

• Banking or financial institution experience
• Relevant certifications such as CISSP, CISM, CISA or CRISC would be considered assets; equivalent practical experience should also be recognized

Education Requirements

• Diploma or Bachelor's degree is required

Required Experience

• 10 years of overall experience in a related discipline

About the Client

This client is a major financial services institution operating in the Canadian banking sector, with a broad national footprint and a workforce of thousands of professionals across its enterprise. The organization is currently undergoing multiple large-scale transformations, offering strong opportunities for growth and development. Teams across the bank include risk analysts, procurement specialists, technology risk professionals, security advisors, contract managers, and sourcing managers who collaborate in a fast-paced, agile environment.

About GTT

GTT is a minority-owned staffing firm and a subsidiary of Chenega Corporation, a Native American-owned company in Alaska. We highly value diverse and inclusive workplaces and support Fortune 500 organizations across banking, financial services, technology, life sciences, biotech, utilities, and retail sectors throughout the U.S. and Canada.

Job Number: 26-17156Industry: Finance & Accounting

#LI-Hybrid