Job Description: Risk Analyst V – Supplier Security & Third-Party Risk
Location: Toronto, ON / Mississauga, ON (Hybrid – 4 days onsite, 1 day remote)
Contract Duration: 10 months, with potential for extension or conversion based on business needs and performance
Position Overview
We are seeking an experienced Risk Analyst V – Supplier Security & Third-Party Risk to support Enterprise Procurement within a leading financial institution. This role will focus on reviewing and negotiating supplier security requirements, assessing third-party technology risks, and ensuring contractual security obligations align with established security policies, risk frameworks, and regulatory expectations.
The successful candidate will serve as a key advisor to Procurement, partnering with Security, Legal, Technology Risk, and contract management teams to evaluate supplier contract amendments, assess proposed exceptions, and recommend appropriate negotiation positions.
This position is ideal for a seasoned information security or third-party risk professional with strong contractual negotiation skills, excellent stakeholder management capabilities, and the ability to translate complex technical requirements into clear business and contractual recommendations.
Key Responsibilities
1. Supplier Security Contract Review and Negotiation
- Review supplier redlines, exceptions, proposed substitutions, exclusions, and qualification language affecting contractual security obligations.
- Assess proposed alternative security controls to determine whether they provide comparable protection based on the supplier’s services, delivery model, data access, hosting arrangements, and risk profile.
- Identify contractual changes that weaken, narrow, qualify, or remove security requirements.
- Translate technical security requirements into clear contractual implications and practical negotiation recommendations.
- Support Procurement and contract managers during supplier negotiations by explaining security requirements, documenting rationale, and recommending acceptable alternative wording within approved guidelines.
2. Third-Party Technology Risk and Security Advisory
- Apply knowledge of information security policies, third-party risk management frameworks, and applicable financial services regulatory expectations, including relevant OSFI requirements.
- Assess supplier security considerations involving public cloud, SaaS, outsourcing, managed services, and other technology-enabled arrangements.
- Evaluate the potential impact of contractual changes on incident notification, audit and assurance rights, access controls, data protection, subcontracting, operational resilience, business continuity, and termination or exit obligations.
- Support alignment between contractual security provisions and supplier risk assessments and control-assessment processes.
- Coordinate with relevant control owners when proposed changes require additional security or risk review.
3. Stakeholder Management and Risk Escalation
- Act as Procurement’s primary point of contact for supplier security contracting questions.
- Coordinate with Security, Legal, Technology Risk, sourcing teams, and contract managers to resolve contractual security matters.
- Resolve issues within approved negotiation playbooks and delegated authority, escalating material deviations, policy exceptions, and risk acceptance decisions to designated stakeholders.
- Prepare concise decision papers outlining proposed changes, applicable standards, risk implications, available options, recommendations, and required approvals.
- Maintain accurate documentation and audit trails of advice, approvals, deviations, and final negotiated positions.
4. Security Contracting Playbooks and Process Improvement
- Maintain and enhance security contracting playbooks, clause guidance, fallback language, negotiation matrices, and escalation thresholds.
- Identify recurring supplier objections and recommend improvements to standard contractual clauses and sourcing processes.
- Provide training, knowledge transfer, and practical guidance to Procurement and contract management teams on security clause interpretation and escalation procedures.
- Support consistent application of approved security requirements across supplier agreements.
5. Initial Contracting Focus
The initial scope will focus on reviewing supplier amendments related to:
- Security Controls: Evaluating proposed changes, alternative controls, qualifications, exclusions, and requests to reduce or remove security obligations.
- Public Cloud Providers: Reviewing amendments to cloud-related security requirements and identifying issues requiring input or approval from Security, Technology Risk, Legal, or other control owners.
- General Security Obligations: Assessing changes to overarching security clauses and their interaction with security schedules, incident handling, compliance obligations, and other related contractual provisions.
Mandatory Qualifications and Experience
- 10+ years of experience in information security, cybersecurity, technology risk, third-party risk, vendor risk, or a closely related discipline.
- 8+ years of experience assessing supplier security controls and third-party technology risks, including cloud, SaaS, outsourcing, or managed services.
- Working knowledge of security and assurance frameworks, including NIST, ISO/IEC 27001/27002, and SOC 1/SOC 2 reports.
- Proven experience interpreting contractual security language, reviewing supplier redlines, negotiating exceptions, and advising on security obligations.
- Experience collaborating with Procurement, Legal, Information Security, and Technology Risk stakeholders.
- Strong understanding of Contract Lifecycle Management (CLM) processes and tools.
- Proficiency in MS Office Suite, including Word, Excel, and PowerPoint.
- Excellent written and verbal communication skills, with the ability to explain technical risks in business-friendly and contractual terms.
- Strong documentation, decision-making, organizational, and negotiation skills.
- Diploma or Bachelor’s degree in a relevant discipline.
Preferred Qualifications
- Previous experience within a bank, financial institution, or regulated financial services environment.
- Familiarity with applicable financial services regulatory expectations, including OSFI requirements.
- Professional certifications such as CISSP, CISM, CISA, or CRISC.
- Equivalent practical experience demonstrating strong security risk and supplier assurance expertise will also be considered.
- Experience developing security contracting guidance, negotiation playbooks, clause libraries, or supplier risk management procedures.
- Experience delivering presentations, training sessions, and knowledge transfer to Procurement or contract management teams.
Dexian stands at the forefront of Talent + Technology solutions with a presence spanning more than 70 locations worldwide and a team exceeding 10,000 professionals. As one of the largest technology and professional staffing companies and one of the largest minority-owned staffing companies in the United States, Dexian combines over 30 years of industry expertise with cutting-edge technologies to deliver comprehensive global services and support.
Dexian connects the right talent and the right technology with the right organizations to deliver trajectory-changing results that help everyone achieve their ambitions and goals. To learn more, please visit https://dexian.com/.
Dexian is an Equal Opportunity Employer that recruits and hires qualified candidates without regard to race, religion, sex, sexual orientation, gender identity, age, national origin, ancestry, citizenship, disability, or veteran status
Thanks & Regards,
