Cybersecurity Vulnerability Engineer

Thales • Ottawa, ON

8d • CA$123,459 - CA$172,843 • Remote

About The Position

This position is responsible for providing ongoing information security services to all aspects of the on premise and cloud corporate IT environments. The Cybersecurity Vulnerability Engineer will require working across several security functions and have a strong primary focus on incident response activities.

Requirements

• Bachelor’s degree in computer information systems, programming, engineering or a related field with a minimum of 5+ years of cybersecurity experience, including at least 3–4 years in vulnerability management, vulnerability analysis, security engineering, incident response, threat intelligence, penetration testing, or a closely related technical security function.
• 5 to 7 years of experience in Cybersecurity domains.
• 3 to 5 years of experience in demonstrated experience analyzing CVEs and determining their relevance and actual impact within complex enterprise environments.
• Strong understanding of vulnerability exploitation, attack paths, operating systems, enterprise applications, networking, authentication, privilege boundaries, and common security controls.
• Ability to interpret vendor advisories, technical security research, proof-of-concept information, logs, configurations, and vulnerability evidence.
• Working knowledge of Windows and Linux environments, network infrastructure, cloud technologies, virtualization, containers, and enterprise applications.
• Ability to independently coordinate urgent, cross-functional technical response activities involving multiple teams and competing priorities.
• Strong organizational skills and the ability to track multiple concurrent vulnerability-response activities through closure.
• Must have working knowledge of threat actor tactics and techniques.

Nice To Haves

• Strong knowledge of all aspects of information security within the Prevent, Detect and Respond domains.
• Must be highly analytical and detail-oriented, with organizational skills to manage assigned work to completion.
• Experience supporting large, complex, or globally distributed enterprise environments.
• Experience working across corporate IT, shared infrastructure, software-development, cloud, and product environments.
• Experience using scripting or automation with Python, PowerShell, APIs, SQL, or similar technologies to support vulnerability analysis and data correlation.

Responsibilities

• Monitor and evaluate newly disclosed and emerging vulnerabilities from Thales CTI, OSINT, Thales CERT, PSIRT, vendor advisories, security researchers, vulnerability databases, and other trusted sources.
• Initiate and coordinate enterprise vulnerability-response activities for vulnerabilities with potential impact to Thales businesses and networks.
• Engage infrastructure, IT, application, cloud, product, and security teams to validate exposure and determine required actions.
• Establish clear ownership, priorities, response timelines, and escalation paths.
• Track remediation and mitigation activities through completion and validate that identified risk has been appropriately addressed.
• Escalate missed timelines, unresolved ownership, significant technical uncertainty, or material residual risk to appropriate leadership.
• Maintain clear status reporting for technical teams, cybersecurity leadership, and other stakeholders.
• Analyze newly disclosed vulnerabilities to understand affected components, exploitation prerequisites, attack vectors, required privileges, exploitability, potential impact, and available mitigations.
• Review CVEs, vendor advisories, security-research publications, proof-of-concept information, exploit intelligence, and relevant technical documentation.
• Assess whether vulnerable technologies or configurations are present in the enterprise and partner with technology owners to validate actual exposure.
• Translate complex vulnerability information into clear, actionable guidance for infrastructure, application, product-development, and leadership teams.
• Partner with detection and incident-response teams when a vulnerability requires investigation for possible prior exploitation or additional monitoring.

Benefits

• Company paid Extended Health, Dental, HSA, Life, AD&D, Short-term Disability, Cancer Care Program, travel insurance, Employee Assistance Plan and Well-Being program.
• Retirement Savings Plans (RRSP, DCPP, TFSA) with a company contribution and a match to a DCPP, with no vesting period.
• Company paid holidays, vacation days, and paid sick leave.
• Voluntary Life, AD&D, Critical Illness, Long-Term Disability.
• Employee Discounts on home, auto, and gym membership.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior