Senior Analyst, Vulnerability Operations

| What we are looking for
Reporting to the Director, Cyber Security & Operations, the Senior Analyst, Vulnerability Operations plays a vital, strategic role in safeguarding Payments Canada's modern infrastructure. The main responsibility of the Senior Analyst, Vulnerability Operations is to lead and mature the cyber vulnerability management program. This is not a siloed, backend technical role; it requires a highly personable technical leader who can translate complex vulnerability data (including CVEs, KEVs, and AI-specific exploits) into strategic business risks. The ideal candidate balances deep technical acumen with exceptional thought leadership to guide both internal teams and external financial sector partners.

The core mission of this role is to lead, scale, and mature our cyber vulnerability management program from traditional infrastructure monitoring to an agile framework capable of defending against threats in an AI world. Specifically, the incumbent will be responsible for managing vulnerabilities across applications, as well as on premise and cloud-based infrastructure.

Responsibilities of the position includes but is not limited to the following:
Research, Analysis & Thought Leadership

Conduct in-depth vulnerability research and analysis.
Produce timely, consolidated, multi-source vulnerability intelligence reports (e.g., vulnerability assessments, briefings,).
Conduct deep-dive research into emerging vulnerability trends, specifically focusing on the intersection of cybersecurity and Frontier AI (e.g., adversarial machine learning, LLM vulnerabilities, and AI supply chain risks).
Translate highly technical vulnerability findings into clear, risk-quantified business narratives for executive leadership and board-level consumption.

Vulnerability Management & Operations

Monitor vulnerabilities through a variety of tools and sources and rank them according to relevance to Payments Canada.
Collaborate with internal stakeholders to define vulnerability operations requirements.
Own, design, and mature the end-to-end vulnerability management lifecycle, evaluating and optimizing SLAs for remediation across corporate and payment systems.
Evolve traditional risk-ranking methodologies by combining CVE and KEV scores with real-world threat intelligence and AI-specific threat modeling (e.g., MITRE ATLAS).
Establish automated workflows and monitoring plans to ingest, filter, and prioritize massive data streams of threat and vulnerability data efficiently.
Report any imminent vulnerabilities to the organization in a timely manner.
Coordinate the response, including reporting, on vulnerabilities to multiple levels of stakeholders.

Engagement with the Organization & External partners

Provide cyber-focused guidance and vulnerability operations support to internal stakeholders.
Facilitate regular, cross-functional risk alignment workshops to help product owners understand the security posture of their applications.
Disseminate reports to inform decision makers about the cyber vulnerability position of the organization. Collaborate with external teams in the Financial and Critical Infrastructure sectors.
Maintain relationships with external partners who are involved in cyber planning or information sharing groups.
Provide subject-matter expertise and support to planning/developmental working groups as appropriate.

Continuous improvement of Security Practices & Processes

Construct vulnerability monitoring plans and matrices using established guidance and procedures.
Regularly audit and adapt the vulnerability monitoring cadence to proactively meet shifting organizational priorities and regulatory demands.
Gather and analyze feedback from internal stakeholders to continually improve the efficiency, accuracy, and actionability of vulnerability reporting.
Champion automation across the collection and processing pipelines to reduce alert fatigue.
Adjust the monitoring plan to address identified issues/challenges and to align with organizational requirements.

Technical Competencies

Proficiency in expressing technical discoveries through creation of reports, briefing notes that are both succinct and comprehensible.
Experience in advanced threat modeling frameworks (e.g., STRIDE, PASTA) expanded to account for systemic AI risks.
Advanced proficiency in threat infrastructure tools and analytic methodologies to chart complex threat campaigns.
Knowledge of enterprise IT networks, cybersecurity ecosystems, and roles and responsibilities.
Knowledge of common computer/network infections (virus, Trojan, etc.) and methods of infection (ports, attachments, etc.)
Knowledge of security capabilities and how those affect exploitation and reduce vulnerability.
Knowledge of criteria for evaluating collection products.
Knowledge of best practices for automation to support the collection and processing of large amounts of threat data/information.
Skilled in using multiple analytic tools, databases, and techniques (e.g., Analyst’s Notebook, A-Space, Anchory, M3, divergent/convergent thinking, link charts, matrices, etc.).
Skilled in writing, reviewing and editing cyber-related products.
Skilled at articulating a needs statement/requirement and integrating new and emerging collection capabilities, accesses and/or processes into the monitoring and reporting plan.
Skilled at preparing and delivering reports, presentations, and briefings, including the use of visual aids or presentation technology.
Skilled in identifying monitoring and reporting gaps.
Proficiency in expressing technical discoveries through creation of reports, briefing notes that are both succinct and comprehensible.

Personal Competencies

Skilled in using critical thinking and an investigative mindset for research and analysis.
Demonstrates strong communication, team work, emotional intelligence and business acumen.
Strong curiosity and drive for solving problems.

| What you need to be successful

Requires a four (4) year degree, or a relevant two (2) year diploma or equivalent combined with two (2) years of additional experience.
Minimum of five (5) years’ experience in IT support, system administration, or security operations is considered good to have.
Minimum of three (3) years’ experience in vulnerability management.
Eligibility to obtain and maintain a Government of Canada Reliability Status Clearance and can successfully complete enhanced background checks that may be carried out by Payments Canada.
Ability to work outside of regular working hours based on operational requirements.
Willing to travel periodically to meet with external partners or attend industry events and conferences.

| You will really stand out with

Industry certification (CISSP, GCTI, CTIA) is considered an asset.
Experience as CTI Analyst, SOC Analyst, or Vulnerability Management Analyst is preferred and considered an asset.

| Salary range

Our target starting rate for this role is $100,300 with flexibility based on your experience and qualifications. The full salary range and benefits package are detailed below.

Please submit your application by September 18, 2026.