Position Title:

Lead Information Security Analyst, Vulnerability and External Attack Surface Management (T & I) (Telework/Hybrid)

Status of Employment:

Permanent

Position Language Requirement:

English, French

Language Skills:

English (Reading - C - Advanced), English (Speaking - C - Advanced), English (Writing - B - Intermediate), French (Reading - C - Advanced), French (Speaking - C - Advanced), French (Writing - B - Intermediate)

This is a hybrid role with a mix of in-office and remote work. Work arrangements will be discussed with hiring managers per departmental guidelines.

Your Role

CBC/Radio-Canada is seeking a Lead Analyst, Vulnerability and External Attack Surface Management, to optimize the Corporation’s vulnerability management program and design, build and deploy its external attack surface management (EASM) service. 

In this role, you will take strategic and operational ownership of this domain. You will establish a comprehensive map of the Corporation’s external digital footprint — including internet-exposed assets, domains, certificates, cloud accounts, public APIs and exposed data — while driving continuous improvements to internal and hybrid vulnerability management. As a recognized subject matter expert, you will serve as a technical authority for leadership, maintain the vulnerability and exposure risk register, and adjudicate security exemption requests across the organization.

This position can be based in Montreal or Toronto.

What’s in It for You

Challenges. We spend our days solving problems of all kinds. Media files are highly nuanced and incredibly complicated; updating, installing and supporting technologies that are organization-wide and that impact broadcasting content is a time-sensitive, complex technical feat. And that’s just the beginning. You’ll be working with leading-edge data management, cloud, IP broadcasting, AI, security and reliability technologies.

As Lead Analyst, you will:

• Map the digital footprint: Identify, classify and inventory CBC/Radio-Canada’s complete external attack surface for the first time, establishing the baseline for domain names, subdomains, public IP address ranges, exposed services, public cloud environments and APIs.
• Implement continuous detection: Develop and execute procedures to detect inadvertently exposed services, expired or vulnerable certificates and leaked credentials or source code on the public web.
• Lead the vulnerability life cycle: Define and optimize end-to-end processes for vulnerability detection, triage, impact analysis, prioritization, remediation and verification.
• Define the scanning strategy: Establish the scope and frequency of automated and manual vulnerability scans across the entire IT environment.
• Assess risk in context: Evaluate discovered vulnerabilities by cross-referencing CVSS scores with business context, asset criticality, existing compensating controls and active threat intelligence (e.g., known exploits).
• Develop remediation plans: Recommend targeted corrective measures — such as patch management, system reconfigurations, temporary workarounds or WAF/firewall rules — for internal teams.
• Lead zero-day response: Provide technical leadership during critical zero-day vulnerabilities and incidents (e.g., Log4j, major OS/hardware flaws), co-ordinating rapid detection and mitigation.
• Evaluate and adjudicate security exemptions: Conduct in-depth technical reviews of exemption requests when prescribed patching or remediation timelines cannot be met. Assess residual risk based on exploitability and asset criticality, requiring robust compensating controls where necessary.
• Manage the vulnerability risk register: Document, maintain and map unpatched vulnerabilities, security technical debt and approved exceptions in the Corporation's risk register. Monitor residual risk levels, update mitigation plans and present clear status reports to governance and executive committees to inform adjudication and investment decisions.
• Partner on compliance and regulatory frameworks: Work closely with the policy and compliance lead to align vulnerability detection and remediation processes with regulatory requirements, internal policies and industry standards.
• Develop metrics and dashboards: Define and track key performance indicators (KPIs) and key risk indicators (KRIs) to monitor program effectiveness.
• Drive program evolution and threat intelligence: Continually enhance security tools and processes to address emerging threats (e.g., zero-day vulnerabilities). Monitor global vulnerability trends, proof-of-concept (PoC) exploits and evolving frameworks (e.g., CVSS v4, MITRE ATT&CK).
• Maintain industry expertise: Stay current on information security best practices and industry trends.
  

What You Bring

• University degree in computer science, IT or information security.
• Minimum five years' experience in vulnerability management, risk assessment or IT governance, including at least three years in an information security role.
• Extensive knowledge of security technology and risk assessment methodologies, policies and processes.
• Excellent written and verbal communication skills, with a demonstrated ability to translate complex technical concepts for non-technical decision-makers (e.g., governance committees, business units, legal teams).
• Excellent analytical, evaluative and problem-solving abilities.
• Experience with compliance programs as well as their technical and security requirements.
• Technical expertise across key domains:
  • Standards and Frameworks: Strong command of industry standards such as ISO/IEC 27001, 27002, 27005, NIST SP 800-53 / 800-161, COBIT and ITIL.
  • Cloud and Web Architecture Security: Solid understanding of web infrastructure and cloud environment security.
  • Network and Security Technologies: Thorough understanding of network architectures (LAN/WAN, routers), network security technologies (firewalls, IDS/IPS, DNS, web filtering) and cryptographic principles (encryption at rest and in transit).
  • Architecture and Data Security: Working knowledge of database architecture concepts and secure software development best practices.
  • Operational Resilience and Physical Security: Solid understanding of business continuity and disaster recovery planning (BCP/DRP), operational resilience and physical security controls.
• Relevant professional security certifications a definite asset (e.g., CISSP, CRISC, CBCP, CISA, CISM or equivalent).
• Bilingualism (English and French) essential.

Candidates may be subject to skills and knowledge testing.

We thank all applicants for their interest, but only candidates selected for an interview will be contacted.

Primary Location:

1000, Rue Papineau, Montreal, Quebec, H2K 0C2

Number of Openings:

1

Work Schedule:

Full time