About the role
Career Center New Search Login Page Position Description Technology & Vendor Risk Specialist Global Location Canada, Montreal-Downtown Hiring Manager email [email protected] Recruiter email [email protected] Apply Now We are seeking a highly skilled Senior Analyst – Technology Risk Management & Third-Party Risk Management (TPRM) to support and strengthen our tech risk program. This role will work closely with the Information Security Governance & Compliance (GRC) team and cross-functional stakeholders to assess, monitor, and manage technology-related risks, in addition to managing the technology risk register. YOU'LL HAVE THE OPPORTUNITY TO: Perform comprehensive risk assessments of third-party vendors delivering technology products and services. Review and analyze vendor responses to cybersecurity and risk questionnaires, including evaluation of supporting documentation and evidence. Conduct technology risk analysis, develop mitigation strategies, and track remediation efforts through to closure. Evaluate and report on residual risk levels, ensuring proper documentation and escalation of high-risk issues. Support and execute technology due diligence activities for both new and existing vendors. Collaborate with internal stakeholders (Procurement, Legal, Privacy, Architecture, and IT teams) to ensure vendor engagements meet internal policies, regulatory
requirements, and industry best practices. Contribute to the continuous improvement of the TPRM framework, processes, and controls. Manage the lifecycle of risk events in the technology risk register Discuss coordinated action plans with IT architecture teams and multiple departments YOU’LL THRIVE IN THIS ROLE IF YOU HAVE THE FOLLOWING SKILLS AND QUALITIES: Proven experience in Technology Third-Party Risk Management (TPRM) and vendor risk assessments. Proven experience in managing 2LoD (second line of defence)
requirements for risk management. Strong understanding of cybersecurity frameworks (e.g., NIST, ISO 27001) and regulatory expectations. Strong understanding of Business continuity and Disaster recovery processes and methodologies Solid knowledge of SOX IT General Controls (ITGCs) and their application to third-party service providers. Hands-on experience in technology risk analysis, remediation planning, and residual risk management. Experience conducting technology due diligence for vendors and service providers, including review of SOC2 type 2 reports, etc. Excellent analytical, communication, and documentation skills. The ability to manage multiple priorities and work independently in a fast-paced environment. ACKNOWLEDGING THE POWER OF DIVERSITY BRP is dedicated to nurturing a culture that invites, connects, and propels the ambitions of people of all backgrounds, profiles, beliefs and experiences. Ultimately, the diversity and uniqueness of our people fuel our ingenuity and set the course for the path ahead! For this reason, we value diversity and we strive to always push each other forward to build an inclusive workplace where every employee feels like they belong, where they can grow and find meaning. AT BRP, WHEN WE TALK ABOUT