Senior Analyst, Enterprise Risk Management (GRC Tool Implementation & Third-Party Risk Focus)

TMX Group•Toronto, ON

7d•CA$85,000 - CA$90,000•Hybrid

About The Position

Join a pivotal second-line position at the heart of Canada's financial market infrastructure. As a Senior Analyst, Enterprise Risk Management, you will support the delivery of the Enterprise Risk Management (ERM) and Operational Resilience programs across the Canadian Depository for Securities (CDS)—Canada's central securities depository, clearing, and settlement hub—and the Canadian Derivatives Clearing Corporation (CDCC)—the national central counterparty for exchange-traded and over-the-counter derivatives—collectively known as “TMX Post-Trade.” You will play a key role in spearheading the deployment and adoption of a new Governance, Risk, and Compliance (GRC) platform designed to automate and elevate complex risk monitoring workflows. This role carries a primary focus on driving digital transformation by transitioning manual frameworks into seamless automated systems, alongside advancing Post-Trade's Third-Party Risk Management (TPRM) program by providing independent second-line support for vendor risk assessments.

Requirements

Bachelor’s degree in Finance, Business Administration, Information Systems, or a related field (Master's degree preferred).
Minimum of 3 years of relevant experience in risk management, compliance, or system implementation within financial services or consulting firms.
Demonstrated experience in the implementation, configuration, or administration of GRC platforms or vendor risk management tools.
Strong technical aptitude with the ability to translate manual risk management processes into automated system workflows.
Proven track record delivering ERM/ORM projects, including Operational Resilience, Risk Appetite, Third-Party Risk Management, Internal Controls, Business Continuity Management, Crisis Management, Cybersecurity, and related operational resilience concepts.
Solid understanding of financial institutions, market infrastructures, and financial markets.
Exceptional written and verbal communication skills, including the ability to articulate complex risk concepts clearly and concisely to diverse audiences.
Proven ability to work independently across multi-stakeholder environments, manage competing priorities effectively, and drive deliverables to completion with minimal supervision.
A proactive and results-oriented approach, demonstrating ownership and accountability for assigned responsibilities.
Must be authorized to work in the country where this position is located.

Nice To Haves

Familiarity with database querying (e.g., SQL) and lightweight scripting languages (e.g., Python, JavaScript) used for data manipulation and automation.
Professional designations in Operational Risk Management, Business Continuity Management, Third-Party Risk Management, and/or Cyber Risk Management (e.g., ORM, CBCP, MBCI).
Knowledge of key regulatory frameworks (e.g., CPMI-IOSCO Principles for FMIs, OSFI B-10, etc.).
Fluency in both French and English (written and spoken) is an asset to support regular interaction with bilingual partners and stakeholders.

Responsibilities

Carry out the design, configuration, deployment, and application of Governance, Risk, Compliance (GRC) Tool to automate and optimize Third Party risk monitoring, assessments, and reporting workflows.
Partner with the GRC tool vendor and internal IT teams to transition manual risk management processes into automated workflows, ensuring the system’s design aligns seamlessly with TMX Post-Trade’s ERM governance.
Support change management efforts for system rollouts by developing comprehensive user guides and delivering training to Business Units on the newly automated processes.
Continuously identify opportunities to streamline existing risk management processes through workflow automation, data integration, and system enhancements.
Support the Manager, ERM in developing and maintaining the TPRM governance framework, ensuring alignment with CDCC and CDS risk appetite.
Support the efficient and effective implementation of the TPRM program across CDCC and CDS, including performing materiality assessment and risk-based due diligence on vendors onboarded as part of new business initiatives and BAU.
Provide guidance and training to Business Units on the requirements and responsibilities included in the TPRM governance.
Contribute to the preparation and delivery of the quarterly reporting process on the third-party risk profile.
Support the Manager, ERM in driving continuous improvement of Post-Trade's TPRM program by analyzing industry trends and benchmarking against evolving global regulations (i.e. DORA), operational resilience and regulatory compliance.
Support the Manager, ERM in addressing non-financial risk regulatory inquiries related to regulatory initiatives and reviews.
Support the Manager, ERM in developing and implementing emerging best practices that align with both regulatory requirements and broader industry standards.
Support the Manager, ERM in monitoring and analyzing internal and external environments to identify emerging risks that may impact TMX Post-Trade's strategic objectives and risk profile, and report to senior management.
Facilitate the end-to-end incident reporting process, ensuring risk events are accurately documented, tracked, and escalated in a timely manner.
Support root cause analyses of identified incidents and partnering with business units to track the implementation of corrective action plans.
Support risk assessment and oversight for operational activities.
Monitor key risk indicators, and analyze operational risk data to identify trends and inform strategic decisions.
Support the identification, assessment, and oversight of the overall risk profile associated with significant changes and projects.
Monitor adherence to change procedures and facilitate post-implementation reviews.
Collaborate with the Information Security Office to track cyber threats, cyber incidents, and remediation efforts.
Assist in embedding cyber risk considerations into broader risk programs and contribute to executive cybersecurity reporting.
Coordinate and maintain Business Impact Analyses (BIA) and Business Continuity Plans (BCP).
Provide training and oversight for Disaster Recovery (DR) and BCP testing.