Senior Analyst, Vulnerability Operations

Role overview

Research and thought leadership

• Conduct in-depth vulnerability research and analysis.
• Produce timely, consolidated vulnerability intelligence reports, assessments, and briefings.
• Research Frontier AI risks, including adversarial machine learning, LLM vulnerabilities, and AI supply-chain risks.
• Translate technical findings into risk-quantified business narratives for executive and board-level audiences.

Vulnerability management operations

• Monitor and prioritize vulnerabilities using multiple tools, sources, CVE and KEV data, threat intelligence, and AI-specific threat modeling.
• Own and mature the end-to-end vulnerability management lifecycle and remediation SLAs.
• Establish automated workflows and monitoring plans for large-scale threat and vulnerability data.
• Report imminent vulnerabilities and coordinate responses across stakeholder groups.

Stakeholder engagement

• Provide vulnerability operations guidance to internal stakeholders and facilitate cross-functional risk alignment workshops.
• Disseminate reports to decision makers and collaborate with financial and critical infrastructure sector partners.
• Maintain relationships with cyber planning and information-sharing groups.

Continuous improvement

• Construct vulnerability monitoring plans and matrices using established guidance and procedures.
• Audit and adapt monitoring cadence to organizational priorities and regulatory demands.
• Improve the efficiency, accuracy, and actionability of vulnerability reporting.
• Champion automation to reduce alert fatigue and address monitoring gaps.

Technical competencies

• Use advanced threat modeling frameworks such as STRIDE and PASTA, expanded for systemic AI risks.
• Apply threat infrastructure tools, analytic methodologies, databases, link charts, matrices, and related analysis techniques.
• Demonstrate knowledge of enterprise IT networks, cybersecurity ecosystems, infections, exploitation, and security capabilities.
• Write, review, edit, present, and brief cyber-related products clearly and succinctly.

Required qualifications

• Four-year degree, or relevant two-year diploma with two additional years of experience, or equivalent.
• At least three years of vulnerability management experience.
• Eligibility for Government of Canada Reliability Status Clearance and enhanced background checks.
• Ability to work outside regular hours and travel periodically for partners and industry events.

Preferred qualifications

• At least five years of IT support, system administration, or security operations experience is considered an asset.
• CISSP, GCTI, or CTIA certification is an asset.
• Experience as a CTI Analyst, SOC Analyst, or Vulnerability Management Analyst is preferred.

Workplace and benefits

• The role offers a flexible hybrid remote and office environment.
• The compensation package may include an annual variable bonus, pension plan, health and dental coverage, paid time off, and professional development opportunities.