Vulnerability Management Senior Analyst

LanceSoft, Inc.; Calgary; On-site; CAD 90,000 - 130,000; Full time

Job summary

LanceSoft, Inc. is seeking a Vulnerability Management Engineer in Calgary, Canada to lead vulnerability assessments for ICS, coordinate OT/IT security activities, and drive remediation with SLAs.

You will perform scans with Tenable, Qualys, and Rapid7, analyze threats, and collaborate with SOC/IR to reduce risk. You will automate workflows using Python/PowerShell and APIs, generate executive dashboards, and continuously improve scanning coverage and MTTR, strengthening our security posture

Qualifications

• Must monitor threat intel and vendor advisories on an ongoing basis.
• Analyze vulnerabilities affecting IC (Industrial Control Systems).
• Conduct vulnerability assessments for IC devices and networks.
• Coordinate activities across OT, IT, cybersecurity and operations teams.
• Perform regular vulnerability scans with Tenable/Qualys/Rapid7 and document gaps.
• Manage end-to-end vulnerability lifecycle from discovery to remediation and validation.
• Collaborate with SOC and IR to address actively exploited flaws and reduce risk.
• Drive continuous improvement in scanning, MTTR and security posture.
• Prioritize risks using threat intel and business impact analysis.
• Ensure patch management and remediation meet SLAs and timelines.
• Validate remediation with re-scans and manual checks; reduce false positives.

Responsibilities

• Monitor threat intelligence and vendor advisories.
• Analyze vulnerabilities affecting ICs and critical assets.
• Perform vulnerability assessments for IC devices.
• Coordinate OT/IT/cybersecurity/ops activities.
• Run regular vulnerability scans using Tenable, Qualys, Rapid7.
• Oversee end-to-end vulnerability lifecycle from discovery to remediation.
• Partner with security operations and incident response teams.
• Deliver improvements to scanning coverage and MTTR reduction.
• Prioritize fixes based on risk and business impact.
• Ensure timely remediation and patching per SLA.
• Validate outcomes with re-scans and manual verification.
• Generate actionable reports and dashboards for teams and executives.
• Leverage Python/PowerShell and APIs to automate workflows.
• Track emerging threats and correlate with organizational risk.

Skills

Threat intelligence monitoring

Vulnerability analysis

Vulnerability lifecycle management

Cross-team coordination

Risk-based prioritization

Remediation leadership

SLA tracking

Reporting and dashboards

Automation scripting

Tools

Rapid7

MCAS

Wiz

Tenable

Qualys

Python

PowerShell

APIs

Job description

• Patch management processes and coordination
• Remediation validation and reporting
• False positive analysis and tuning
• SLA tracking and compliance alignment
• Hands-on experience in Rapid7, MCAS, Wiz.

Must-Have

• Monitor threat intelligence and vendor advisories.
• Analyze vulnerabilities affecting IC (Industrial Control Systems)
• Analyze and Conduct vulnerability assessments for IC devices
• Coordinate activities between OT, IT, cybersecurity, and operations teams
• Conducted regular vulnerability scans across network, systems, and applications using tools such as Tenable, Qualys, and Rapid7, identifying critical security gaps.
• Managed the end-to-end vulnerability lifecycle including identification, assessment, prioritization, remediation, and validation.
• Partnered with security operations and incident response teams to address actively exploited vulnerabilities and reduce attack surface.
• Delivered continuous improvement initiatives to enhance scanning coverage, reduce MTTR, and strengthen overall security posture.
• Performed risk-based prioritization using threat intelligence, and business impact to focus remediation on high-risk vulnerabilities.
• Drive timely remediation and patch management, ensuring SLA adherence.
• Validated remediation efforts through re-scans and manual verification, reducing false positives and ensuring accurate closure.
• Analyzed vulnerability data and generated actionable reports and dashboards for technical teams and executive stakeholders.
• Leveraged automation using Python/PowerShell and APIs to streamline vulnerability scanning, reporting, and remediation workflows.
• Monitored emerging threats using CVE, and threat intelligence feeds, correlating exploitability with organizational risk.
• Ensured compliance with industry standards and frameworks such as NIST, CIS Benchmarks, ISO 27001, and PCI-DSS.

Good-to-Have

• Experience in dealing with customers directly and working in a global delivery model.
• Good Assertive Communication (Written & Oral)