Location
Ottawa and Toronto, CA - Hybrid
Other Canadian locations - Remote
About the role
The Vulnerability Management Specialist, as a proficient-level professional with well-defined experience, will be primarily responsible for the enterprise Vulnerability Management program, ensuring that vulnerabilities across Kinaxis assets are discovered, prioritized by risk and remediated in a timely manner, as part of a global Security team that is responsible for all security-related handling for Kinaxis Corporate and Kinaxis RapidResponse Software-as-a-Service.
The incumbent will administer and continuously tune the vulnerability management platform, translate threat intelligence and vendor advisories into actionable, risk-based priorities, and drive remediation through strong coordination and clear guidance. This person will interface with cross functional teams within Kinaxis such as Corporate IT, SaaS Operations, Cloud Platform Engineering, Product Development, Business Systems teams, Customer Success, and Technology partners to reduce the organization6s attack surface and maintain company-wide information security.
Vacancy Status
This is an existing job vacancy
What you will do
Vulnerability Management Platform and Scanning
- Administer, configure and continuously tune the enterprise vulnerability management platform (scanners, agents, credentials, scan policies, asset tagging and integrations) to ensure complete and accurate coverage of assets across Kinaxis Corporate and SaaS environments.
- Measure and close asset coverage gaps by reconciling the platform against authoritative asset sources (CMDB, cloud inventories, EDR) and onboarding new environments as they are introduced.
- Automate and maintain scheduled vulnerability scans, and run on-demand scans in response to threat intelligence, zero-day disclosures or vendor security advisories.
- Manage the relationship with the vulnerability management platform vendor, holding regular check-ins, conducting periodic platform health checks, tracking support cases and evaluating new capabilities.
Threat Intelligence and Risk-Based Prioritization
- Review threat intelligence feeds and vendor advisories for applicability, and triage the impact of newly disclosed vulnerabilities on Kinaxis systems and services.
- Apply risk-based vulnerability management to prioritize remediation using exploitability (e.g., CISA KEV, EPSS), CVSS severity, asset criticality, exposure and business context.
Remediation Coordination and Risk Mitigation
- Coordinate vulnerability remediation with remediation teams (Corporate IT, Cloud Services and Product teams), tracking tickets through to closure against defined SLAs.
- Provide clear and concise remediation guidance, including patches, configuration changes, compensating controls and other risk mitigation options, tailored to each remediation team.
- Set up and lead regular meetings with remediation teams to review and discuss vulnerability backlogs, overdue items, blockers and risk exceptions.
- Coordinate with other members of the Security team to mitigate risks resulting from vulnerabilities, including the response to critical and actively exploited vulnerabilities.
Reporting, Documentation and Continuous Improvement
- Produce quarterly vulnerability management reports showing key metrics, including asset coverage, prioritized tickets, vulnerability remediation velocity, vulnerability age and SLA compliance.
- Develop and maintain vulnerability management procedures, runbooks and standards, including scanning schedules, remediation SLAs, exception handling and escalation paths.
- Design and operate approved AI-assisted workflows for vulnerability enrichment, clustering, prioritization, remediation guidance and reporting, validating AI output against authoritative vulnerability, asset and threat sources and applying human review, traceability, least-privilege and sensitive-data controls.
- Measure the value of AI assistance (e.g., false-positive reduction, analyst rework, data completeness, remediation cycle efficiency) and assess vulnerabilities and attack-surface risks introduced by enterprise generative and agentic AI services within the role6s approved scope.
- Respond to customer enquiries about vulnerabilities discovered on Kinaxis services, providing accurate, timely and approved responses in coordination with other relevant teams.
What we are looking for
- Bachelor6s degree in Information Security, Computer Science, Information Management Systems, or similar, or equivalent experience.
- 3-5 years of experience in IT Operations, IT Security, or similar; high-tech, global organization is preferred (minimum of 2 years6 hands-on experience in enterprise vulnerability management).
- Industry certifications such as CompTIA Security+, CompTIA CySA+, or GIAC (e.g., GEVA, GCED); see Role Specific Skills, Experience and Industry Certifications below.
- Understanding of relevant governance and control frameworks and standards related to vulnerability management (e.g., NIST CSF, NIST SP 800-40, NIST SP 800-53, ISO 27000 Series, CIS Controls, SOC 1/2, PCI-DSS, FedRAMP) is preferred.
- A clear, concise, and professional communicator with the ability to explain technical vulnerability risk and remediation guidance to engineers, service owners, customers and leadership.
#Intermediate
