Risk Analyst

Job Title -Risk Analyst

Duration: 10 Months

Location –Hybrid 4d Onsite (Toronto, ON OR Mississauga ,ON )

Key Responsibilities

A. Supplier Security Schedule Review and Negotiation

• Review supplier redlines, exceptions, proposed substitutions and qualification language affecting security obligations.
• Assess whether proposed alternative controls provide comparable protection, taking account of the supplier’s services, delivery model, data access, hosting arrangements and risk profile.
• Translate technical security requirements into clear contractual implications and practical negotiation recommendations for Procurement.
• Support sourcing and contract managers in supplier discussions, including explaining requirements, documenting rationale and proposing acceptable wording within approved positions.
• Identify changes that weaken, qualify, narrow or remove security obligations and distinguish routine drafting issues from substantive control or risk changes.

B. Financial Services and Third-Party Risk Advisory

• Apply knowledge of the organization’s security policies, third-party risk framework and applicable financial-services regulatory expectations, including relevant OSFI requirements, as directed by internal control owners.
• Consider supplier access to information, systems, environments and services, including cloud, SaaS, outsourcing and other technology-enabled arrangements.
• Identify when a supplier proposal may affect incident notification, audit and assurance, access controls, data protection, subcontracting, resilience, business continuity or termination/exit obligations.
• Support alignment between contractual security requirements and the supplier risk assessment and control-assessment process.

C. Stakeholder Coordination and Escalation

• Act as Procurement’s primary point of contact for supplier security-contracting questions and coordinate input from Security, Legal and Technology Risk.
• Resolve matters that fall within approved playbooks and delegated authority; escalate material deviations, policy exceptions and risk acceptance decisions to the designated owners.
• Prepare concise decision papers identifying the proposed change, relevant standard, risk implication, options, recommendation and required approver.
• Maintain an audit trail of advice, approvals, deviations and final negotiated positions.

D. Playbooks and Process

• Help maintain security-contracting playbooks, clause guidance, fallback language, negotiation matrices and escalation thresholds.
• Identify recurring supplier objections and recommend improvements to standard clauses, guidance and sourcing processes.
• Provide training and practical guidance to sourcing managers and contract managers on security clause interpretation and escalation procedures.

Initial Contracting Scope

The position would initially focus on supplier amendments to the following provisions identified for this business case. The advisor should validate clause-specific requirements against the current approved agreement templates, standards and playbooks before providing negotiation advice.

Security Controls

Review supplier redlines to detailed security controls, including proposed alternative controls, qualifications, exclusions and requests to reduce or remove obligations. Assess contractual and control implications and recommend positions consistent with approved security requirements.

Public Cloud Provider

Review supplier changes relating to public-cloud delivery and associated security obligations. Coordinate assessment of cloud-specific concerns and identify changes requiring input or approval from Security, Technology Risk, Legal or other control owners.

Security

Review changes to overarching security obligations and their interaction with the security schedules and related contractual provisions. Identify potential impacts on incident handling, compliance with security requirements and consistency across the agreement.

MUST-HAVE Hard Skills:

1.) 10+ years of experience within information security, cybersecurity, technology risk, third-party/vendor risk, or a closely related discipline

2.) 8+ years of experience assessing supplier security controls and third-party technology risks, including cloud, SaaS, outsourcing or managed services

3.) Working knowledge of security and assurance frameworks such as NIST, ISO/IEC 27001/27002 and SOC 1/SOC 2 reports

4.) Experience interpreting contractual security language, negotiating supplier exceptions, and working with Procurement, Legal and Security stakeholders

5.) Ability to communicate technical issues in clear business and contractual terms, document decisions and manage multiple negotiations

6.) Strong knowledge of Contract Lifecycle Management (CLM)

7.) Strong knowledge of MS Office Suite

SOFT SKILLS:

1.) Strong communication skills (written and verbal)

2.) Strong presentation skills

3.) Ability to train procurement teams, provide knowledge transfers etc.

NICE-TO-HAVE

1.) Banking or financial institution experience

2.) Relevant certifications such as CISSP, CISM, CISA or CRISC would be considered assets; equivalent practical experience should also be recognized

About Dexian: Dexian stands at the forefront of Talent + Technology solutions with a presence spanning more than 70 locations worldwide and a team exceeding 10,000 professionals. As one of the largest technology and professional staffing companies and one of the largest minority-owned staffing companies in the United States, Dexian combines over 30 years of industry expertise with cutting-edge technologies to deliver comprehensive global services and support.

Dexian connects the right talent and the right technology with the right organizations to deliver trajectory-changing results that help everyone achieve their ambitions and goals.

To learn more, please visit https://dexian.com/.

Dexian is an Equal Opportunity Employer that recruits and hires qualified candidates without regard to race, religion, sex, sexual orientation, gender identity, age, national origin, ancestry, citizenship, disability, or veteran status.

Note: Dexian Canada will, on request, provide accommodations for disabilities to support