Technology & Vendor Risk Specialist

BRP•Montreal, QC

2d•Hybrid

About The Position

We are seeking a highly skilled Senior Analyst – Technology Risk Management & Third-Party Risk Management (TPRM) to support and strengthen our tech risk program. This role will work closely with the Information Security Governance & Compliance (GRC) team and cross-functional stakeholders to assess, monitor, and manage technology-related risks, in addition to managing the technology risk register.

Requirements

Proven experience in Technology Third-Party Risk Management (TPRM) and vendor risk assessments.
Proven experience in managing 2LoD (second line of defence) requirements for risk management.
Strong understanding of cybersecurity frameworks (e.g., NIST, ISO 27001) and regulatory expectations.
Strong understanding of Business continuity and Disaster recovery processes and methodologies
Solid knowledge of SOX IT General Controls (ITGCs) and their application to third-party service providers.
Hands-on experience in technology risk analysis, remediation planning, and residual risk management.
Experience conducting technology due diligence for vendors and service providers, including review of SOC2 type 2 reports, etc.
Excellent analytical, communication, and documentation skills.
The ability to manage multiple priorities and work independently in a fast-paced environment.

Responsibilities

Perform comprehensive risk assessments of third-party vendors delivering technology products and services.
Review and analyze vendor responses to cybersecurity and risk questionnaires, including evaluation of supporting documentation and evidence.
Conduct technology risk analysis, develop mitigation strategies, and track remediation efforts through to closure.
Evaluate and report on residual risk levels, ensuring proper documentation and escalation of high-risk issues.
Support and execute technology due diligence activities for both new and existing vendors.
Collaborate with internal stakeholders (Procurement, Legal, Privacy, Architecture, and IT teams) to ensure vendor engagements meet internal policies, regulatory requirements, and industry best practices.
Contribute to the continuous improvement of the TPRM framework, processes, and controls.
Manage the lifecycle of risk events in the technology risk register
Discuss coordinated action plans with IT architecture teams and multiple departments