Third-Party Risk Analyst

Third-Party Risk Analyst (TPRM)

Location: Toronto, ON

Work Arrangement: Hybrid – 2 days onsite per week (Tuesday and Thursday)

Contract Duration: December 22, 2026 – June 19, 2027

Compensation: $50–$57/hour (Incorporated)

Extension/Conversion: Potential for extension or permanent conversion

Industry: Financial Services

About the Opportunity

We are seeking a Third-Party Risk Analyst to support the Third-Party Risk Management (TPRM) program of a leading financial services organization.

The successful candidate will be responsible for assessing, challenging, and monitoring third-party risks throughout the vendor lifecycle, ensuring compliance with internal policies, regulatory requirements, and risk governance frameworks.

The primary focus of this role (approximately 80%) is conducting and reviewing Inherent Risk Questionnaires (IRQs), with the remaining 20% focused on financial risk reviews, subcontractor assessments, supplier monitoring, and other TPRM activities.

This opportunity is ideal for someone with hands-on experience in third-party risk assessments, vendor governance, compliance, or audit who is comfortable working independently and engaging with multiple stakeholders.

Key Responsibilities

• Conduct and provide effective challenge of Inherent Risk Questionnaires (IRQs), ensuring responses are accurate, complete, and aligned with third-party risk requirements.
• Identify inconsistencies, gaps, and potential risks related to supplier engagements, including service criticality, data sensitivity, technology dependencies, and regulatory impact.
• Perform third-party due diligence, including financial risk assessments, supplier financial health reviews, and adverse/negative media screening.
• Support subcontractor reviews, ongoing supplier monitoring, and third-party risk governance activities.
• Identify, document, track, and escalate risk findings, control gaps, and remediation actions.
• Ensure compliance with internal TPRM policies, governance frameworks, and applicable regulatory requirements, including OSFI Guideline B-10 where relevant.
• Collaborate with Contract Owners, Procurement, Compliance, Audit, and Risk Management teams to support effective third-party oversight.
• Maintain accurate risk assessment documentation, audit trails, and reporting.
• Contribute to continuous improvement of TPRM processes, controls, and risk assessment methodologies.

Must-Have Qualifications

• 2–5 years of relevant experience in Third-Party Risk Management (TPRM), Vendor Risk Management, Compliance, Internal/External Audit, or Technology/Information Risk.
• Hands-on experience conducting, reviewing, or challenging Inherent Risk Questionnaires (IRQs) and inherent risk assessments.
• Strong understanding of third-party governance, risk management, and compliance/audit principles.
• Experience conducting or supporting third-party due diligence, financial risk reviews, adverse media reviews, ongoing supplier monitoring, and issue/remediation tracking.
• Understanding of the third-party/vendor lifecycle, including onboarding, risk assessments, due diligence, monitoring, and governance.
• Strong analytical skills with the ability to critically assess risk information, identify inconsistencies, and escalate concerns.
• Excellent communication, stakeholder management, and documentation skills.
• Ability to work independently, manage multiple priorities, and collaborate effectively with cross-functional teams.

Nice-to-Have Qualifications

• Previous experience within banking, financial services, or another regulated industry.
• Familiarity with OSFI Guideline B-10 and third-party risk regulatory requirements.
• Experience using TPRM or vendor management platforms such as Archer, Ivalua, or ProcessUnity.
• Experience reviewing SOC reports, ISO certifications, audit reports, or other risk and control documentation.
• Understanding of cybersecurity, information security, privacy, business continuity, and technology risk concepts.
• Exposure to emerging third-party risks involving AI, cloud services, and concentration risk.

What We're Looking For

We're looking for a proactive, detail-oriented professional with strong third-party risk knowledge who can confidently assess risk questionnaires, challenge incomplete or inconsistent information, and work collaboratively with business stakeholders.

The ideal candidate is a self-starter, eager to learn, adaptable, and comfortable navigating risk governance processes within a regulated environment.

Note: We use AI tools to: obtain basic information, detect plagiarism, false employment history or references, categorize your skills, and do an initial match with job posting