Third-Party Risk Analyst (TPRM)
Location: Toronto, ON
Work Arrangement: Hybrid – 2 days onsite per week (Tuesday and Thursday)
Contract Duration: December 22, 2026 – June 19, 2027
Compensation: $50–$57/hour (Incorporated)
Extension/Conversion: Potential for extension or permanent conversion
Industry: Financial Services
About the Opportunity
We are seeking a Third-Party Risk Analyst to support the Third-Party Risk Management (TPRM) program of a leading financial services organization.
The successful candidate will be responsible for assessing, challenging, and monitoring third-party risks throughout the vendor lifecycle, ensuring compliance with internal policies, regulatory requirements, and risk governance frameworks.
The primary focus of this role (approximately 80%) is conducting and reviewing Inherent Risk Questionnaires (IRQs), with the remaining 20% focused on financial risk reviews, subcontractor assessments, supplier monitoring, and other TPRM activities.
This opportunity is ideal for someone with hands-on experience in third-party risk assessments, vendor governance, compliance, or audit who is comfortable working independently and engaging with multiple stakeholders.
Key Responsibilities
- Conduct and provide effective challenge of Inherent Risk Questionnaires (IRQs), ensuring responses are accurate, complete, and aligned with third-party risk requirements.
- Identify inconsistencies, gaps, and potential risks related to supplier engagements, including service criticality, data sensitivity, technology dependencies, and regulatory impact.
- Perform third-party due diligence, including financial risk assessments, supplier financial health reviews, and adverse/negative media screening.
- Support subcontractor reviews, ongoing supplier monitoring, and third-party risk governance activities.
- Identify, document, track, and escalate risk findings, control gaps, and remediation actions.
- Ensure compliance with internal TPRM policies, governance frameworks, and applicable regulatory requirements, including OSFI Guideline B-10 where relevant.
- Collaborate with Contract Owners, Procurement, Compliance, Audit, and Risk Management teams to support effective third-party oversight.
- Maintain accurate risk assessment documentation, audit trails, and reporting.
- Contribute to continuous improvement of TPRM processes, controls, and risk assessment methodologies.
Must-Have Qualifications
- 2–5 years of relevant experience in Third-Party Risk Management (TPRM), Vendor Risk Management, Compliance, Internal/External Audit, or Technology/Information Risk.
- Hands-on experience conducting, reviewing, or challenging Inherent Risk Questionnaires (IRQs) and inherent risk assessments.
- Strong understanding of third-party governance, risk management, and compliance/audit principles.
- Experience conducting or supporting third-party due diligence, financial risk reviews, adverse media reviews, ongoing supplier monitoring, and issue/remediation tracking.
- Understanding of the third-party/vendor lifecycle, including onboarding, risk assessments, due diligence, monitoring, and governance.
- Strong analytical skills with the ability to critically assess risk information, identify inconsistencies, and escalate concerns.
- Excellent communication, stakeholder management, and documentation skills.
- Ability to work independently, manage multiple priorities, and collaborate effectively with cross-functional teams.
Nice-to-Have Qualifications
- Previous experience within banking, financial services, or another regulated industry.
- Familiarity with OSFI Guideline B-10 and third-party risk regulatory requirements.
- Experience using TPRM or vendor management platforms such as Archer, Ivalua, or ProcessUnity.
- Experience reviewing SOC reports, ISO certifications, audit reports, or other risk and control documentation.
- Understanding of cybersecurity, information security, privacy, business continuity, and technology risk concepts.
- Exposure to emerging third-party risks involving AI, cloud services, and concentration risk.
What We're Looking For
We're looking for a proactive, detail-oriented professional with strong third-party risk knowledge who can confidently assess risk questionnaires, challenge incomplete or inconsistent information, and work collaboratively with business stakeholders.
The ideal candidate is a self-starter, eager to learn, adaptable, and comfortable navigating risk governance processes within a regulated environment.
Note: We use AI tools to: obtain basic information, detect plagiarism, false employment history or references, categorize your skills, and do an initial match with job posting
