Title: Supplier Security & Third-Party Risk Advisor (Contract)
Location: Downtown Toronto or Mississauga, ON | Hybrid, 4 days onsite
Type: 10-month contract, with potential to extend or convert
Hours: Monday to Friday, 37.5 hours/week
About the role
Infotek Consulting is hiring a senior Supplier Security & Third-Party Risk Advisor for the Enterprise Procurement team at a major Canadian bank. You’ll be Procurement’s go-to expert on security obligations in supplier contracts: reviewing redlines, assessing proposed alternative controls, and turning technical security requirements into clear, practical negotiation positions.
What you’ll do
- Review supplier redlines, exceptions and substitutions to security schedules, including Security Controls, Public Cloud Provider and overarching Security provisions
- Assess whether proposed alternative controls offer comparable protection, based on the supplier’s services, delivery model, hosting, data access and risk profile
- Advise sourcing and contract managers in supplier negotiations and propose acceptable wording within approved positions
- Identify changes that weaken, narrow or remove security obligations, and separate routine drafting issues from material risk changes
- Apply OSFI expectations and the bank’s third-party risk framework across cloud, SaaS, outsourcing and managed services arrangements
- Coordinate input from Security, Legal and Technology Risk, and escalate material deviations and risk acceptance decisions
- Prepare concise decision papers and maintain an audit trail of advice, approvals and final negotiated positions
- Help maintain playbooks, clause guidance, fallback language and escalation thresholds, and train procurement teams on security clause interpretation
What you bring
- 10+ years in information security, cybersecurity, technology risk or third-party/vendor risk
- 8+ years assessing supplier security controls and third-party technology risk (cloud, SaaS, outsourcing, managed services)
- Working knowledge of NIST, ISO/IEC 27001/27002 and SOC 1/SOC 2 reports
- Hands-on experience interpreting contractual security language and negotiating supplier exceptions with Procurement, Legal and Security stakeholders
- Strong knowledge of Contract Lifecycle Management (CLM) and MS Office Suite
- Excellent written, verbal and presentation skills, and comfort training others
- Diploma or Bachelor’s degree
Nice to have
- Banking or financial services experience
- CISSP, CISM, CISA or CRISC (equivalent practical experience is also recognized)
Why this role
- Net-new position on an 80-person team in the middle of multiple transformations
- Real influence: you’ll help shape the playbooks, not just follow them
- Strong opportunity to learn and grow inside one of Canada’s largest banks
Background checks will be conducted for this position.
