Risk Analyst V
Randstad CanadaOur client, is seeking an experienced, highly detail-oriented Risk Analyst V (Supplier Security & Third-Party Risk Advisory Specialist) to join their enterprise technology risk and procurement advisory group.
In this strategic, high-visibility role, you will act as the primary point of contact for supplier security contracting questions and third-party risk assessments. Working in a hybrid capaci
...
ty, you will review supplier redlines, assess alternative controls, and translate technical cybersecurity requirements into clear contractual positions and negotiation guidelines for Procurement and Legal teams. You will evaluate supplier risks across cloud, SaaS, and managed service environments, aligning contractual security provisions with internal risk control frameworks and applicable financial services regulatory expectations (such as OSFI standards).
Duration: 10-Month Contract (Full-time engagement)
Work Arrangement: Hybrid (4 days per week on-site at corporate offices; 1 day work from home; flexible anchor days)
Advantages
High-Visibility Strategic Scope: Serve as the core bridge between Procurement, Legal, Cybersecurity, and Technology Risk teams on major enterprise vendor contracts.
Complex Risk Negotiations: Drive high-value contract redlines, evaluating security provisions, incident response triggers, and data protection clauses for public cloud and SaaS integrations.
Enterprise Governance Impact: Maintain and optimize security-contracting playbooks, negotiation matrices, and fallback clause guidance across the organization.
Balanced Hybrid Model: Enjoy workplace flexibility with a 4-day on-site and 1-day remote work schedule.
Responsibilities
Supplier Security Schedule Review & Negotiation: Review supplier redlines, exceptions, and proposed alternative controls affecting security obligations, evaluating risks across cloud, SaaS, and technology-enabled arrangements.
Procurement & Legal Collaboration: Partner directly with sourcing managers and legal teams during supplier discussions, explaining technical security requirements, documenting rationale, and proposing acceptable fallback language.
Third-Party Risk Advisory & Regulatory Alignment: Apply knowledge of enterprise security frameworks, third-party risk management policies, and financial services regulatory expectations (including OSFI guidelines) to supplier agreements.
Contractual Impact Assessment: Identify clause changes affecting incident notification timelines, audit/assurance rights, access controls, data protection, subcontracting, and termination/exit obligations.
Stakeholder Escalation & Decision Papers: Prepare concise decision papers for leadership summarizing proposed changes, risk implications, and recommendations; maintain complete audit trails of approvals and negotiated positions.
Playbook Governance & Enablement: Help maintain security-contracting playbooks and fallback clause guidance while training procurement and contract management teams on security clause interpretations.
Qualifications
Information Security & Risk Depth: 10+ years of dedicated professional experience within information security, cybersecurity, technology risk, or third-party/vendor risk management (TPRM).
Supplier & Cloud Risk Assessment: 8+ years of hands-on experience assessing supplier security controls and third-party technology risks (cloud, SaaS, outsourcing, managed services).
Security Framework Knowledge: Deep working knowledge of security and assurance frameworks, including NIST, ISO/IEC 27001/27002, and SOC 1 / SOC 2 audit reports.
Contract Language & Negotiation Experience: Proven track record interpreting complex contractual security language, negotiating supplier redlines, and partnering with Procurement and Legal teams.
CLM & Tools Proficiency: Strong expertise working with Contract Lifecycle Management (CLM) platforms and Microsoft Office Suite.
Communication & Training Abilities: Exceptional written and verbal communication skills, with a proven ability to p