Senior Risk Analyst

Title: Supplier Security & Third-Party Risk Advisor (Contract)

Location: Downtown Toronto or Mississauga, ON | Hybrid, 4 days onsite

Type: 10-month contract, with potential to extend or convert

Hours: Monday to Friday, 37.5 hours/week

About the role

Infotek Consulting is hiring a senior Supplier Security & Third-Party Risk Advisor for the Enterprise Procurement team at a major Canadian bank. You’ll be Procurement’s go-to expert on security obligations in supplier contracts: reviewing redlines, assessing proposed alternative controls, and turning technical security requirements into clear, practical negotiation positions.

What you’ll do

• Review supplier redlines, exceptions and substitutions to security schedules, including Security Controls, Public Cloud Provider and overarching Security provisions
• Assess whether proposed alternative controls offer comparable protection, based on the supplier’s services, delivery model, hosting, data access and risk profile
• Advise sourcing and contract managers in supplier negotiations and propose acceptable wording within approved positions
• Identify changes that weaken, narrow or remove security obligations, and separate routine drafting issues from material risk changes
• Apply OSFI expectations and the bank’s third-party risk framework across cloud, SaaS, outsourcing and managed services arrangements
• Coordinate input from Security, Legal and Technology Risk, and escalate material deviations and risk acceptance decisions
• Prepare concise decision papers and maintain an audit trail of advice, approvals and final negotiated positions
• Help maintain playbooks, clause guidance, fallback language and escalation thresholds, and train procurement teams on security clause interpretation

What you bring

• 10+ years in information security, cybersecurity, technology risk or third-party/vendor risk
• 8+ years assessing supplier security controls and third-party technology risk (cloud, SaaS, outsourcing, managed services)
• Working knowledge of NIST, ISO/IEC 27001/27002 and SOC 1/SOC 2 reports
• Hands-on experience interpreting contractual security language and negotiating supplier exceptions with Procurement, Legal and Security stakeholders
• Strong knowledge of Contract Lifecycle Management (CLM) and MS Office Suite
• Excellent written, verbal and presentation skills, and comfort training others
• Diploma or Bachelor’s degree

Nice to have

• Banking or financial services experience
• CISSP, CISM, CISA or CRISC (equivalent practical experience is also recognized)

Why this role

• Net-new position on an 80-person team in the middle of multiple transformations
• Real influence: you’ll help shape the playbooks, not just follow them
• Strong opportunity to learn and grow inside one of Canada’s largest banks

Background checks will be conducted for this position.