Senior Vulnerability Management Analyst
Job Type: Permanent
Location: Montreal / Hybrid, 3 days onsite
Salary: $90,000 - $110,000 + benefits
Your New Company
Our client is a large, established Canadian organisation with a significant technology footprint. They are looking for an experienced Senior Vulnerability Management Analyst to join their Cybersecurity team and play a key role in strengthening vulnerability management, risk-based remediation, and the organisation’s overall security posture.
Your New Role
As the Senior Vulnerability Management Analyst, you will take a senior, hands-on role in identifying, assessing, prioritising, and driving the remediation of vulnerabilities across a complex enterprise environment.
Rather than simply reviewing vulnerability scan results, you will determine the true risk and criticality of vulnerabilities by considering CVSS scores, exploitability, exposure, threat intelligence, business impact, and existing security controls. You will work closely with Infrastructure, Cloud, IT Operations, Development, and Cybersecurity teams to ensure the highest-risk vulnerabilities are addressed appropriately.
As a senior member of the team, you will also provide technical guidance to other analysts, help coordinate vulnerability management activities and priorities, and be capable of stepping into a team leadership role when management is unavailable.
What You Need to Do
- Monitor emerging threats, CVEs, security advisories, and threat intelligence to identify vulnerabilities relevant to the organisation.
- Perform and coordinate vulnerability assessments across servers, endpoints, cloud environments, infrastructure, and enterprise applications.
- Analyse and validate vulnerabilities based on CVSS, exploitability, exposure, attack vectors, threat context, business impact, and organisational risk.
- Determine the true criticality of vulnerabilities and establish risk-based remediation priorities.
- Provide actionable remediation guidance, including patching requirements, mitigation strategies, and compensating controls.
- Work closely with Infrastructure, Network, Cloud, Development, IT Operations, and Cybersecurity teams to drive remediation within established SLAs.
- Track vulnerabilities through ITSM workflows and ensure appropriate ownership, documentation, escalation, and closure.
- Validate remediation activities through testing and maintain accurate vulnerability and exception records.
- Provide technical guidance to team members and help coordinate vulnerability management priorities and activities.
- Act as a point of leadership for the team when management is unavailable, helping maintain priorities, coordinate activities, and escalate critical security risks when required.
- Support the continued enhancement of CMDB and asset inventory capabilities to improve asset and vulnerability visibility.
- Develop vulnerability management metrics, dashboards, and executive reporting covering risk exposure, remediation progress, trends, and security posture.
- Support security audits, compliance activities, and continuous improvement of the vulnerability management programme.
- Plan and deploy phishing simulations and cybersecurity awareness initiatives across the organisation.
What You’ll Need to Succeed
- University degree or diploma in Computer Science, Information Technology, Cybersecurity, IT Security, or a related discipline.
- 5–7+ years of relevant IT/Cybersecurity experience, with strong experience in vulnerability management, vulnerability assessment, or security operations.
- Demonstrated hands-on experience identifying, analysing, prioritising, and driving the remediation of enterprise security vulnerabilities.
- Strong knowledge of CVE/CVSS frameworks, exploitability analysis, attack vectors, threat intelligence, vulnerability prioritisation, patch management, and risk assessment.
- Experience with vulnerability and security platforms such as Rapid7 InsightVM, Tenable/Nessus, Qualys, Armis, Microsoft Defender for Endpoint, VIPR Pro, or equivalent technologies.
- Experience using ServiceNow or other ITSM platforms to track remediation activities, exceptions, ownership, and SLAs.
- Strong understanding of enterprise infrastructure, including operating systems, networks, cloud environments, servers, firewalls, endpoints, and databases.
- Ability to assess vulnerabilities beyond scanner severity and determine their real-world risk to the organisation.
- Previous experience providing technical leadership, mentoring analysts, coordinating team priorities, or acting as a senior escalation point.
- Confidence stepping into a team leadership capacity when management is unavailable, while remaining technically hands-on.
- Strong stakeholder management skills and the ability to influence remediation across Infrastructure, Cloud, Network, Development, IT Operations, and Security teams.
- Ability to communicate complex vulnerability and cyber risk information clearly to both technical stakeholders and management.
- Cybersecurity certifications such as CompTIA Security+, CEH, GIAC GSEC, or equivalent are considered an asset.
What You’ll Get in Return
You will have the opportunity to take on a senior, highly visible cybersecurity position within a complex enterprise environment. This role offers the opportunity to remain technically hands-on while taking greater ownership of vulnerability management activities, influencing security priorities across multiple technology teams, and providing leadership when required.
You’ll receive competitive compensation, professional development opportunities, and the opportunity to make a meaningful impact on the organisation’s cybersecurity posture.
What You Need to Do Now
If you're interested in this role, click 'apply now' to forward an up-to-date copy of your CV, or call us now.
If this job isn't quite right for you, but you are looking for a new position, please contact us for a confidential discussion about your career.
This posting is for an existing vacancy with the organisation.
AI may be used to screen, assess or select applicants for the position.
