Risk Analyst V

Our Client, a Banking company, is looking for a Risk Analyst V for their  Toronto, ON /Mississauga, ON/Hybrid location.
 
Responsibilities:

• Supplier Security Schedule Review and Negotiation
• Review supplier redlines, exceptions, proposed substitutions and qualification language affecting security obligations.
• Assess whether proposed alternative controls provide comparable protection, taking account of the supplier’s services, delivery model, data access, hosting arrangements and risk profile.
• Translate technical security requirements into clear contractual implications and practical negotiation recommendations for Procurement.
• Support sourcing and contract managers in supplier discussions, including explaining requirements, documenting rationale and proposing acceptable wording within approved positions.
• Identify changes that weaken, qualify, narrow or remove security obligations and distinguish routine drafting issues from substantive control or risk changes.
• Financial services and third-party risk advisory
• Apply knowledge of the organization’s security policies, third-party risk framework and applicable financial-services regulatory expectations, including relevant OSFI requirements, as directed by internal control owners.
• Consider supplier access to information, systems, environments and services, including cloud, SaaS, outsourcing and other technology-enabled arrangements.
• Identify when a supplier proposal may affect incident notification, audit and assurance, access controls, data protection, subcontracting, resilience, business continuity or termination/exit obligations.
• Support alignment between contractual security requirements and the supplier risk assessment and control-assessment process.
• Stakeholder coordination and escalation
• Act as Procurement’s primary point of contact for supplier security-contracting questions and coordinate input from Security, Legal and Technology Risk.
• Resolve matters that fall within approved playbooks and delegated authority; escalate material deviations, policy exceptions and risk acceptance decisions to the designated owners.
• Prepare concise decision papers identifying the proposed change, relevant standard, risk implication, options, recommendation and required approver.
• Maintain an audit trail of advice, approvals, deviations and final negotiated positions.
• Playbooks and process
• Help maintain security-contracting playbooks, clause guidance, fallback language, negotiation matrices and escalation thresholds.
• Identify recurring supplier objections and recommend improvements to standard clauses, guidance and sourcing processes.
• Provide training and practical guidance to sourcing managers and contract managers on security clause interpretation and escalation procedures.
• Initial contracting scope
• The position would initially focus on supplier amendments to the following provisions identified for this business case.
• The advisor should validate clause-specific requirements against the current approved agreement templates, standards and playbooks before providing negotiation advice.
• Security controls
• Review supplier redlines to detailed security controls, including proposed alternative controls, qualifications, exclusions and requests to reduce or remove obligations.
• Assess contractual and control implications and recommend positions consistent with approved security requirements.
• Public cloud provider
• Review supplier changes relating to public-cloud delivery and associated security obligations. Coordinate assessment of cloud-specific concerns and identify changes requiring input or approval from Security, Technology Risk, Legal or other control owners.
• Security
• Review changes to overarching security obligations and their interaction with the security schedules and related contractual provisions.
• Identify potential impacts on incident handling, compliance with security requirements and consistency across the agreement.

• 10+ years of experience within information security, cybersecurity, technology risk, third-party/vendor risk, or a closely related discipline
• 8+ years of experience assessing supplier security controls and third-party technology risks, including cloud, SaaS, outsourcing or managed services
• Working knowledge of security and assurance frameworks such as NIST, ISO/IEC 27001/27002 and SOC 1/SOC 2 reports
• Experience interpreting contractual security language, negotiating supplier exceptions, and working with Procurement, Legal and Security stakeholders
• Ability to communicate technical issues in clear business and contractual terms, document decisions and manage multiple negotiations
• Strong knowledge of Contract Lifecycle Management (CLM)
• Strong knowledge of MS Office Suite
• Soft skills:
• Strong communication skills (written and verbal)
• Strong presentation skills
• Ability to train procurement teams, provide knowledge transfers etc.
• Nice-to-have
• Banking or financial institution experience
• Relevant certifications such as CISSP, CISM, CISA or CRISC would be considered assets; equivalent practical experience should also be recognized

• Health Benefits
• Referral Program
• Excellent growth and advancement opportunities