Manager, Vulnerability Management
About The Position
We are seeking an experienced Vulnerability Management Manager to lead and manage our centralized vulnerability management function for Canada Life. This role is critical to protecting our business, data, and clients by driving a risk-based approach to identifying, assessing, and responding to emerging threats, while prioritizing and coordinating the remediation of existing vulnerabilities across the enterprise. The ideal candidate will have deep expertise in the vulnerability management lifecycle, strong leadership skills, and the ability to collaborate across various departments and stakeholders. As part of our Information Security team, you will align with regulatory expectations and industry best practices to deliver a mature and effective vulnerability management program. Your work will directly contribute to minimizing risks, safeguarding sensitive information, and enhancing the overall cybersecurity posture of our organization.
Requirements
- Bachelor’s degree in computer science, Information Security, or a related field.
- 5+ years of experience in vulnerability management with at least 3 years in a leadership role.
- Demonstrated experience leading vulnerability management teams.
- Strong project management skills and the ability to manage multiple issues and priorities simultaneously.
Nice To Haves
- Certifications such as GIAC GEVA, CISSP, CRISC, or CompTIA PenTest+ are highly desirable.
- Experience in the insurance or financial services sector is a strong asset.
- Familiarity with privacy regulations (PIPEDA, GDPR, CCPA) and industry compliance requirements.
- Experience working with executive leadership and Board-level communications during incidents.
Responsibilities
- Lead a centralized, risk-driven vulnerability management function to reduce enterprise cyber risk and enhance executive visibility
- Define and maintain vulnerability management strategy, standards, governance, and reporting frameworks aligned to regulatory expectations
- Operate a comprehensive program to identify, assess, prioritize, and track vulnerabilities across applications, infrastructure, and cloud environments
- Oversee end-to-end vulnerability lifecycle management, ensuring clear ownership, accountability, and timely remediation
- Tailor vulnerability reporting to reflect asset criticality, risk exposure, and organizational priorities
- Drive performance measurement and continuous improvement of remediation effectiveness and timeliness
- Serve as the primary escalation point for vulnerability-related risks and decisions
- Continuously evaluate emerging cyber threat intelligence and assess relevance to the enterprise and industry
- Incorporate threat intelligence, exploit data, and attack trends into vulnerability prioritization and response strategies
- Partner with technology, engineering, and business teams to identify, prioritize, and remediate vulnerabilities aligned to organizational risk
- Collaborate with internal audit, governance, and risk management functions to ensure alignment with corporate policies and regulatory requirements
- Communicate vulnerability posture, remediation performance, and material risk exposures to senior leadership through clear, concise reporting
- Provide timely communication during critical vulnerabilities, including impact assessment, response actions, and mitigation plans
- Translate technical vulnerability data into actionable business risk insights for non-technical stakeholders
- Influence stakeholders to prioritize remediation based on risk, exploitability, and business impact
- Develop, implement, and continuously enhance the vulnerability management framework in alignment with evolving threats, business objectives, and regulatory requirements
- Establish and maintain policies, standards, and procedures aligned with industry best practices
- Define and track key performance indicators (KPIs) and metrics to measure program effectiveness, efficiency, and maturity
- Establish and execute the vision, strategy, and roadmap for the vulnerability management program
- Define governance structures, roles, and responsibilities to support effective program execution
- Lead and coordinate response efforts during critical vulnerability events, such as zero-day exposures
- Ensure scalable, consistent processes across infrastructure, applications, cloud, and endpoint environments
- Foster a culture of accountability, continuous improvement, and strong security ownership
Benefits
- Opportunities for career advancement
- Access to industry-leading learning programs
- Up to $2,000 annually towards education reimbursement
- Flexible health and dental benefits
- $5,000 mental health benefit
- In addition to regular vacation and personal days
- Volunteer day
- Company-matching pension plan
- Share ownership program
- Additional investment options
- Employee recognition programs
- Service milestone celebrations
- Employee discounts
- Workplace where employees feel connected and supported through Employee Resource Groups (ERGs), mentorship programs, social clubs and events.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Manager
