Security Specialist, Vulnerability Management

Accountabilities:

• Establish comprehensive visibility across cloud, application, container, Kubernetes, network, endpoint, dependency, firmware, and customer-premises equipment environments, covering both internal and internet-facing assets.
• Design, configure, and maintain authenticated and unauthenticated vulnerability scans, agent-based assessments, cloud-native checks, container and dependency scans, attack-surface discovery, and targeted validation activities.
• Evaluate and administer vulnerability-management and security-testing platforms, integrating multiple tools to provide effective coverage rather than relying on a single technology.
• Define safe scanning procedures, credentials, rate limits, exclusions, maintenance windows, and testing processes to minimize impact on production systems and customer environments.
• Review and validate vulnerability findings, distinguishing true positives, false positives, duplicates, accepted risks, mitigated conditions, and actionable vulnerabilities.
• Analyze CVEs using affected versions, configurations, package provenance, firmware or software inventories, runtime reachability, network exposure, privileges, exploit prerequisites, and existing security controls.
• Prioritize remediation using technical severity, known exploitation, exploit availability, exposure, reachability, asset criticality, customer impact, and compensating controls.
• Establish remediation targets by risk level, escalate actively exploited or internet-facing vulnerabilities, and coordinate emergency response when necessary.
• Partner with Engineering and DevOps teams on patches, upgrades, configuration changes, dependency updates, container rebuilds, firmware releases, and compensating controls, while verifying remediation through rescans or equivalent evidence.
• Manage vulnerability exceptions with documented rationale, appropriate approvals, compensating controls, expiration dates, and scheduled reassessments.
• Assess security risks across the complete cloud-to-device environment, including APIs, device-management protocols, access networks, gateways, routers, ONTs, and connected-home devices.
• Identify affected device models, hardware revisions, firmware branches, software components, and deployed customer cohorts, supporting safe remediation planning and rollout validation.
• Build automation and integrations for asset enrichment, deduplication, risk scoring, ticket creation, ownership routing, SLA tracking, notifications, rescanning, exception management, and evidence collection.
• Maintain dashboards and reporting covering vulnerability coverage, exploitable exposure, aging, remediation performance, repeat findings, exceptions, ownership, and risk trends.
• Develop operating standards, playbooks, and procedures for vulnerability handling, critical CVEs, zero-day response, scanner administration, and tool outages.
• Provide clear reporting to technical and executive stakeholders, distinguishing raw vulnerability volumes from material business risk and highlighting overdue actions or required decisions.
• Support audits and customer security inquiries with traceable evidence while maintaining strict controls over sensitive vulnerability and customer information.

Requirements

• 5+ years of hands-on experience in vulnerability management, vulnerability assessment, security engineering, product security, cloud security, or a closely related discipline.
• Demonstrated experience owning enterprise vulnerability-management workflows, including scanner configuration, authenticated scanning, coverage analysis, finding validation, false-positive management, remediation tracking, and rescanning.
• Strong CVE analysis capabilities, with the ability to assess applicability and exploitability based on versions, configurations, exposure, reachability, privileges, controls, and business context.
• Experience with enterprise vulnerability platforms and practical familiarity with complementary cloud, container, dependency, application, and open-source security scanning tools.
• Working knowledge of CVE/CWE, NVD, CVSS, CISA Known Exploited Vulnerabilities, EPSS, vendor advisories, software bills of materials, and risk-based prioritization.
• Hands-on understanding of Linux, TCP/IP, DNS, TLS/PKI, identity and access controls, APIs, cloud infrastructure, containers, and Kubernetes.
• Ability to review code, package manifests, container images, configurations, logs, and network evidence to validate findings and guide remediation.
• Scripting or programming experience with Python, Go, PowerShell, Bash, or a comparable language, as well as experience integrating security platforms with APIs, ticketing systems, and dashboards.
• Strong written and verbal communication skills, with the ability to explain technical risk, uncertainty, trade-offs, and remediation decisions to engineers, operational teams, and leadership.
• Bachelor's degree in cybersecurity, computer science, engineering, or equivalent practical experience.
• Experience with service providers, broadband operators, telecommunications technology, managed networks, or large distributed device fleets is an asset.
• Familiarity with embedded Linux, firmware, broadband gateways, routers, ONTs, Wi-Fi/mesh systems, IoT, or other customer-premises equipment is an advantage.
• Knowledge of TR-069/CWMP, TR-369/USP, TR-181, device provisioning, telemetry, certificates, and remote firmware lifecycle management is considered an asset.
• Experience with Google Cloud Platform, Kubernetes, Terraform, Helm, CI/CD, and cloud-native security posture or workload-protection platforms is preferred.
• Experience with software composition analysis, SBOM/VEX, container and image scanning, secret scanning, SAST/DAST, API security testing, or infrastructure-as-code scanning is valuable.
• Familiarity with coordinated vulnerability disclosure, penetration-test findings, zero-day response, or product security incident response is a plus.
• Knowledge of security frameworks and standards such as NIST Cybersecurity Framework, NIST SP 800-40, CIS Controls, OWASP, PCI DSS, SOC 2, or ISO 27001 is advantageous.
• Relevant certifications such as Security+, CySA+, GSEC, GCIH, GPEN, CISSP, CCSP, or vendor-specific vulnerability-management credentials are welcome, although practical expertise is valued more highly than certification alone.
• Strong ownership, analytical thinking, prioritization, and problem-solving abilities, with the confidence to challenge scanner results and remediation claims constructively while maintaining clear evidence, accountability, and deadlines.
• Availability to work primarily during normal business hours, with escalation availability for critical, actively exploited, or zero-day vulnerabilities.
• Ability to manage sensitive vulnerability, exploit, and customer information according to strict need-to-know and evidence-control requirements.

Benefits

• Contract position with an hourly compensation range of CAD $60–$90 per hour, depending on experience and expertise.
• Fully remote position available across Canada.
• Opportunity to work on a broad and technically complex security environment spanning cloud, applications, Kubernetes, networking, software supply chains, firmware, and connected devices.
• High-impact role with significant ownership in establishing and maturing a company-wide vulnerability management capability.
• Cross-functional collaboration with engineering, DevOps, operations, product, support, and compliance teams.
• Opportunity to work with modern security technologies and vulnerability-management platforms across multiple security domains.
• Inclusive and diverse working environment with a commitment to equal opportunity and objective, skills-based recruitment.