Vulnerability Management Analyst

Apptoza Inc.; Calgary; On-site; CAD 95,000 - 125,000; Full time

Job summary

Apptoza Inc. is seeking an IT security professional to lead vulnerability management for ICS environments in Calgary. You will coordinate OT/IT teams, perform regular vulnerability assessments using leading tools, and drive remediation within SLAs.

Responsibilities include building dashboards, reporting to technical and executive stakeholders, and automating scanning and remediation workflows with Python/PowerShell and APIs. Strong threat intel skills and standards compliance are required.

Qualifications

• Monitor threat intelligence and vendor advisories.
• Analyze vulnerabilities affecting ICS/OT environments.
• Perform vulnerability assessments for ICS devices.
• Coordinate activities across OT, IT, cybersecurity and operations.
• Conduct regular vulnerability scans using Tenable, Qualys and Rapid7.
• Manage end-to-end vulnerability lifecycle from discovery to remediation.
• Partner with security operations and incident response teams.
• Deliver scanning coverage improvements and MTTR reductions.
• Prioritize risk using threat intel and business impact.
• Drive remediation and patch management within SLAs.
• Validate remediation via re-scans and manual checks.
• Analyze data and produce actionable reports for technical and execs.
• Automate workflows with Python/PowerShell and APIs.
• Monitor CVEs and threat feeds; assess exploitability risk.
• Ensure compliance with NIST, CIS, ISO 27001 and PCI-DSS.

Responsibilities

• Lead vulnerability scanning programs across network, systems and applications.
• Coordinate remediation activities with OT, IT and security teams.
• Track SLAs and ensure timely patching and remediation.
• Validate fixes and reduce false positives through re-scans.
• Create dashboards and reports for technical and executive audiences.

Skills

Vulnerability management

Threat intelligence

OT/IT coordination

Remediation lifecycle

SLA tracking

Reporting dashboards

Automation scripting

Python scripting

PowerShell scripting

CVE monitoring

NIST compliance

Tools

Tenable

Qualys

Rapid7

MCAS

Wiz

Job description

• Patch management processes and coordination
• Remediation validation and reporting
• False positive analysis and tuning
• SLA tracking and compliance alignment
• Hands-on experience in Rapid7, MCAS, Wiz.

Must-Have

• Monitor threat intelligence and vendor advisories.
• Analyze vulnerabilities affecting ICs (Industrial Control Systems)
• Analyze and Conduct vulnerability assessments for ICs devices
• Coordinate activities between OT, IT, cybersecurity, and operations teams
• Conducted regular vulnerability scans across network, systems, and applications using tools such as Tenable, Qualys, and Rapid7, identifying critical security gaps.
• Managed the end-to-end vulnerability lifecycle including identification, assessment, prioritization, remediation, and validation.
• Partnered with security operations and incident response teams to address actively exploited vulnerabilities and reduce attack surface.
• Delivered continuous improvement initiatives to enhance scanning coverage, reduce MTTR, and strengthen overall security posture.
• Performed risk-based prioritization using threat intelligence, and business impact to focus remediation on high-risk vulnerabilities.
• Drive timely remediation and patch management, ensuring SLA adherence.
• Validated remediation efforts through re-scans and manual verification, reducing false positives and ensuring accurate closure.
• Analyzed vulnerability data and generated actionable reports and dashboards for technical teams and executive stakeholders.
• Leveraged automation using Python/PowerShell and APIs to streamline vulnerability scanning, reporting, and remediation workflows.
• Monitored emerging threats using CVE, and threat intelligence feeds, correlating exploitability with organizational risk.
• Ensured compliance with industry standards and frameworks such as NIST, CIS Benchmarks, ISO 27001, and PCI-DSS.

Good-to-Have

• Experience in dealing with customers directly and working in a global delivery model.
• Good Assertive Communication (Written & Oral)