Third-Party Risk Analyst Job Burnaby area,BC Canada,IT/Tech

Third-Party Risk Management (TPRM) is responsible for making sure the outside parties Clio relies on, including software vendors, service providers, and platform integrators it lists in the App Marketplace, meet Clio's bar for security and privacy before they touch Clio or customer data
We sit inside the vendor lifecycle as the security compliance review phase of Procurement, after intake and in parallel with Legal and IT. We work closely with IT, Privacy, Legal, and the App Ecosystem team to deliver strong, documented, defensible assessments of security posture and risk
As a Third-Party Risk Analyst, you are the person who reads the security documentation and advises on the risk of third-party relationships. You own the day-to-day execution of the security review phase, working through vendor submissions, reviewing SOC 2 and penetration test reports, checking data handling against our requirements, and reviewing the security and privacy submissions of partners applying to list in Clio's App Marketplace
When the third party’s criticality is higher, you step up the documentation criteria and adapt. You apply an established set of criteria commensurate with the service provided, surface real risk from paperwork, and keep reviews moving
You don’t need to have seen every framework or every control, but you need to know what a good answer looks like, what questions to ask when something’s missing, and when to elevate rather than wave something through
Review vendor security documentation submitted through the intake process, including SOC 2 reports, penetration test summaries, security whitepapers, AI disclosures, and questionnaire responses, and determine whether the vendor meets Clio's required level of security and privacy
Review App Marketplace integration submissions and evaluate the security and privacy documentation of integration partners applying to list on Clio. Flag exceptions that could put customer data or Clio's brand at risk before a partner is added to the marketplace
Triage for privacy review by identifying when a vendor or integration will process confidential or sensitive data and route it into a Data Privacy Impact Assessment (DPIA), partnering with Privacy/Compliance
Escalate for risk acceptance when a risk is identified in the review process. Document and present it to the appropriate stakeholder for decision making
Move reviews through the workflow by tracking submissions, requesting missing artifacts from requesters and vendors, responding to comments, and handing off cleanly to IT, Legal, and executive sign-off
Document your findings and decisions. Record what you reviewed, what you found, the risks identified, and your recommendation so the rationale is reusable and audit-ready
Maintain the third-party risk registry
Support renewals and reassessments by re-reviewing vendors on renewal or change of scope
Keep the review criteria and runbooks accurate. Follow the established process and flag when a checklist, threshold, or template is out of date or unclear

Benefits

Specialized learning and development programs and access to an in-house performance coach
Equitable compensation for your contributions, regardless of gender, race, or any other identifying factor
Access to pay transparency on all of our global roles
Company equity for applicable employees
RRSP-matching in Canada, 401k in the US, and pension plans in Ireland
Hybrid model - striking the right balance between the benefits of in person connectivity that in office brings, and the flexibility of remote
Flexible paid time off (4-week minimum with opportunities for personalization based on individual needs and achievements)
Parental leave options for birthing and non-birthing parents
A $500 contribution to your child's RESP
Various…