Risk Analyst V

Our Client a Banking company is looking for a Risk Analyst V for their Toronto ON /Mississauga ON/Hybrid location.

Responsibilities:

• Supplier Security Schedule Review and Negotiation
• Review supplier redlines exceptions proposed substitutions and qualification language affecting security obligations.
• Assess whether proposed alternative controls provide comparable protection taking account of the suppliers services delivery model data access hosting arrangements and risk profile.
• Translate technical security requirements into clear contractual implications and practical negotiation recommendations for Procurement.
• Support sourcing and contract managers in supplier discussions including explaining requirements documenting rationale and proposing acceptable wording within approved positions.
• Identify changes that weaken qualify narrow or remove security obligations and distinguish routine drafting issues from substantive control or risk changes.
• Financial services and third-party risk advisory
• Apply knowledge of the organizations security policies third-party risk framework and applicable financial-services regulatory expectations including relevant OSFI requirements as directed by internal control owners.
• Consider supplier access to information systems environments and services including cloud SaaS outsourcing and other technology-enabled arrangements.
• Identify when a supplier proposal may affect incident notification audit and assurance access controls data protection subcontracting resilience business continuity or termination/exit obligations.
• Support alignment between contractual security requirements and the supplier risk assessment and control-assessment process.
• Stakeholder coordination and escalation
• Act as Procurements primary point of contact for supplier security-contracting questions and coordinate input from Security Legal and Technology Risk.
• Resolve matters that fall within approved playbooks and delegated authority; escalate material deviations policy exceptions and risk acceptance decisions to the designated owners.
• Prepare concise decision papers identifying the proposed change relevant standard risk implication options recommendation and required approver.
• Maintain an audit trail of advice approvals deviations and final negotiated positions.
• Playbooks and process
• Help maintain security-contracting playbooks clause guidance fallback language negotiation matrices and escalation thresholds.
• Identify recurring supplier objections and recommend improvements to standard clauses guidance and sourcing processes.
• Provide training and practical guidance to sourcing managers and contract managers on security clause interpretation and escalation procedures.
• Initial contracting scope
• The position would initially focus on supplier amendments to the following provisions identified for this business case.
• The advisor should validate clause-specific requirements against the current approved agreement templates standards and playbooks before providing negotiation advice.
• Security controls
• Review supplier redlines to detailed security controls including proposed alternative controls qualifications exclusions and requests to reduce or remove obligations.
• Assess contractual and control implications and recommend positions consistent with approved security requirements.
• Public cloud provider
• Review supplier changes relating to public-cloud delivery and associated security obligations. Coordinate assessment of cloud-specific concerns and identify changes requiring input or approval from Security Technology Risk Legal or other control owners.
• Security
• Review changes to overarching security obligations and their interaction with the security schedules and related contractual provisions.
• Identify potential impacts on incident handling compliance with security requirements and consistency across the agreement.

• 10 years of experience within information security cybersecurity technology risk third-party/vendor risk or a closely related discipline
• 8 years of experience assessing supplier security controls and third-party technology risks including cloud SaaS outsourcing or managed services
• Working knowledge of security and assurance frameworks such as NIST ISO/IEC 27001/27002 and SOC 1/SOC 2 reports
• Experience interpreting contractual security language negotiating supplier exceptions and working with Procurement Legal and Security stakeholders
• Ability to communicate technical issues in clear business and contractual terms document decisions and manage multiple negotiations
• Strong knowledge of Contract Lifecycle Management (CLM)
• Strong knowledge of MS Office Suite
• Soft skills:
• Strong communication skills (written and verbal)
• Strong presentation skills
• Ability to train procurement teams provide knowledge transfers etc.
• Nice-to-have
• Banking or financial institution experience
• Relevant certifications such as CISSP CISM CISA or CRISC would be considered assets; equivalent practical experience should also be recognized

• Health Benefits
• Referral Program
• Excellent growth and advancement opportunities