Vulnerability Management

Job Title: Vulnerability Management Analyst

Location: Montreal, QC (Hybrid 2-3 days onsite)

Duration: Full time role

Pay Rate: 75-80k CAD

Job Description:

The Vulnerability Management Analyst is primarily responsible for supporting the identification, assessment, and remediation of security vulnerabilities within the company's IT systems and infrastructure. Working closely with the IT team and Cybersecurity Operations team, the Analyst helps reduce cyber risk by evaluating the severity of vulnerabilities in a contextualized manner. The analyst will be responsible for determining the true criticality of security flaws and prioritizing threat-hunting activities, mitigation efforts, and remediation actions accordingly.

Key Accountabilities

• Monitor emerging threats, CVEs, security advisories, and threat intelligence sources; perform and coordinate vulnerability assessments across servers, endpoints, cloud environments, and enterprise applications;
• Analyze and validate identified vulnerabilities, assessing risk based on factors such as exposure, exploitability, business impact, and threat context. Prioritize remediation efforts according to organizational risk tolerance and security requirements;
• Classify vulnerabilities by severity and provide actionable remediation recommendations, including patching requirements, compensating controls, and mitigation strategies when fixes are not immediately available;
• Partner with Infrastructure, IT Operations, Cloud, and Development teams to coordinate timely remediation activities. Track vulnerabilities through IT service management workflows and ensure compliance with established SLAs;
• Verify remediation effectiveness through validation testing, maintain vulnerability and exception records, and support security audits and compliance initiatives;
• Contribute to the ongoing enhancement of the CMDB and asset inventory to improve asset visibility, risk assessment, and vulnerability management capabilities; and
• Develop and communicate vulnerability management metrics, dashboards, and executive reports, providing visibility into risk exposure, remediation progress, and overall security posture while recommending continuous process improvements.

Job Requirements

• University degree or Diploma in Computer Science, IT or IT Security/Cybersecurity;
• Minimum of three (3) years of IT experience in a similar position;
• Solid understanding of operating systems, networking, cloud environments, and infrastructure security, including servers, firewalls, and databases;
• Knowledge of vulnerability management and risk assessment principles, including CVE/CVSS frameworks, exploitability analysis, attack vectors, and vulnerability prioritization;
• Experience with vulnerability management, patch management, and ITSM platforms, such as VIPR Pro, Rapid7 InsightVM, Armis, ServiceNow, Tenable/Nessus, Qualys, or Microsoft Defender for Endpoint;
• Strong analytical and problem-solving skills with the ability to assess technical risks, prioritize remediation efforts, and produce clear, well-documented findings;
• Excellent communication and collaboration skills, with experience working cross-functionally with infrastructure, network, cloud, development, and security teams;
• Relevant cybersecurity certifications such as CompTIA Security+, CEH, GIAC GSEC, or equivalent are considered an asset.