Senior IT Security Vulnerability & Risk Analyst

OXARO Inc.; Quebec; Hybrid; CAD 85,000 - 110,000; Full time

Job summary

OXARO Inc. is seeking a Vulnerability Analyst for a remote role with Montreal-based meetings (2 per month). The assignment spans 3 years with a potential 1-year extension, and requires Reliability Status clearance.

You will lead vulnerability analyses, document results, and present findings to stakeholders to support authorization decisions. Key duties include planning security analyses, reviewing VAPT results, tailoring controls, and providing knowledge transfer.

Qualifications

• Minimum three distinct projects delivering at least four security deliverables (SA&As, SRTMs, SARs, SoRAs, ATO Packages).
• Experience applying Government of Canada cybersecurity requirements and applicable standards (ITSG-33, NIST, ISO 27001).
• Experience reviewing VAPT results and documenting findings.

Responsibilities

• Plan and initiate Security Vulnerability Analysis activities with stakeholders and deliverables.
• Perform security vulnerability analyses across IT systems and document findings.
• Assess risks and recommend mitigations for identified vulnerabilities.
• Review VAPT results and validate implementation evidence.
• Assess and tailor security controls and review control implementations.
• Support risk-based authorization decisions and ongoing monitoring.

Skills

Security analysis

Risk assessment

Stakeholder facilitation

Documentation

Communication

Job description

Location: Remote with 2 meetings/month in Montreal

Duration: 3 years (plus a 1-year option to extend)

Security Clearance: Reliability Status

Responsibilities

• Plan and initiate IT Security Vulnerability Analysis (SVA) activities, identifying key stakeholders, required documentation, and expected deliverables.
• Perform security vulnerability analysis across IT systems, assess systems, and document findings.
• Evaluate risks associated with identified vulnerabilities and recommend mitigation measures.
• Review Vulnerability Assessment and Penetration Testing (VAPT) results and validate implementation evidence.
• Assess and tailor security controls and review security control implementations.
• Assess cybersecurity risks from existing Threat and Risk Assessments (TRAs) and support residual risk determination.
• Develop, review, and complete security vulnerability analysis deliverables and supporting documentation.
• Review system architectures, conduct document reviews, and support assessment workshops.
• Present findings and recommendations to stakeholders and participate in technical discussions.
• Support the preparation of authorization packages and risk-based authorization decisions.
• Support periodic reviews, reassessments, and continuous monitoring activities.
• Provide knowledge transfer to internal personnel through presentations, briefings, workshops, and the sharing of methodologies and lessons learned.

Qualifications

• A minimum of three (3) distinct projects of experience in developing, reviewing, updating, or supporting the preparation of a minimum of four (4) of the following deliverables:
• SA&A Plans;
• Security Requirements Traceability Matrices (SRTMs);
• Security Assessment Reports (SARs);
• Statements of Risk Acceptance (SoRAs); and
• Authorization to operate Packages.
• Experience developing, reviewing, and completing security vulnerability analyses, including presenting findings and recommendations to stakeholders.
• Experience applying Government of Canada cybersecurity requirements, Canadian Centre for Cyber Security (CCCS) guidance, ITSG-33, NIST, ISO 28001, or other recognized cybersecurity frameworks or standards in support of vulnerability assessments, risk assessments, or authorization activities.
• Experience assessing IT systems, documenting findings, and evaluating risks.
• Experience reviewing Vulnerability Assessment and Penetration Testing (VAPT) results.
• Strong communication and stakeholder facilitation skills to support risk-based decisions while maintaining project objectives.

AI Disclosure

We do not use artificial intelligence (AI) tools to screen, assess, or select applicants at any stage of our recruitment process. All applications are reviewed by our recruitment team.

OXARO is committed to fostering an inclusive, equitable and respectful workplace where every individual feels valued and empowered to contribute their best. We believe that diversity drives innovation and strengthens our ability to serve our clients and communities. We are dedicated to ensuring a fair and unbiased recruitment process and welcome applications from members of the four designated groups under the Employment Equity Act: women, Indigenous peoples, persons with disabilities and members of visible minorities.

Accommodations are available upon request for candidates taking part in all aspects of the recruitment process.

We sincerely thank all applicants for their interest in this opportunity. While we appreciate every application, only those selected for an interview will be contacted.