Vulnerability Management Specialist – Application Security

Aarorn Technologies Inc. • Toronto, ON

2d • Remote

About The Position

The Vulnerability Management Specialist – Application Security is responsible for end-to-end management of application security vulnerabilities across the SDLC using SAST, DAST, and SCA tools, with a strong focus on risk-based prioritization, remediation tracking, and posture visibility through ASPM platforms. This role requires strong hands-on experience in interpreting findings from various scanning tools, facilitating remediation, and communicating progress to stakeholders.

Requirements

• Web Application Security
• Mobile Application Security
• API Security
• SAST (Static Application Security Testing)
• SCA (Software Composition Analysis)
• Vulnerability Management lifecycle
• Risk Assessment & Prioritization (considering CVSS scores, exploitability, asset criticality, business impact, and threat intelligence)
• Hands-on expertise with vulnerability scanning tools (e.g., Nessus, Qualys, Rapid7, OpenVAS) and the ability to interpret scan results accurately, reduce false positives, and tune scans for different environments.
• Strong coordination skills to drive timely patching and mitigation—working with IT, cloud, DevOps, and application teams to remediate vulnerabilities while minimizing operational and business disruption.
• Ability to translate technical vulnerability data into clear, actionable reports for different audiences (engineers, management, auditors), including dashboards, trends, SLAs, and risk narratives.
• Knowledge of security frameworks and standards and the skill to embed vulnerability management into continuous security processes, audits, and metrics-driven improvement.
• Strong hands on experience with SAST (e.g., AppScan, Check Marx, GitHub Advanced Security)
• Strong hands on experience with DAST tools and runtime testing approaches
• Strong hands on experience with SCA / OSS security and dependency risk analysis
• Working knowledge of ASPM platforms and vulnerability aggregation.
• Understanding of OWASP Top 10, secure coding practices, and application threat models.
• Must be from global support background.
• Strong documentation, presentation, and communication skills
• 8-10 + years of experience in application security or vulnerability management roles.
• Experience supporting enterprise scale AppSec programs with multiple applications and teams.
• Good knowledge of information security areas as Vulnerability Management Lifecycle, hardening controls (CIST, NIST) etc.
• Good understanding of information security related fields, including security operations and administration
• Possess good understanding of assets, threats and vulnerabilities and their correlation in an organization
• Good understanding of vulnerability reports from tools like Qualys/ Tenable etc.
• Strong practical knowledge of vulnerability remediation tracking across infrastructure, applications, and teams/ 3rd parties
• Knowledge on vulnerability exception management process

Nice To Haves

• Familiarity with RBVM/ASPM tools like ArmorCode, Seemplicity, Brinqa a plus.
• Hands on experience on vulnerability prioritization tool, RiskSense or Kenna would be a plus.
• Good to have Experience on vulnerability scanning tools Like Qualys and Tenable.

Responsibilities

• Interpret findings across SAST, SCA, Secrets, API and Mobile scanning (tools like GitHub Advanced Security, Traceable, etc)
• Hand-off findings to development teams for remediation
• Provide technical remediation assistance to product development teams
• Track and report remediation progress
• Facilitate extension requests for remediation timelines
• Collaborate across teams using JIRA for ticketing and dashboards
• Present vulnerability remediation tracking updates to management
• Perform vulnerability patching
• Handle customer interactions effectively

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed