Cybersecurity Vulnerability Engineer

Location:

Ottawa, Canada

In fast changing markets, customers worldwide rely on Thales. Thales is a business where brilliant people from all over the world come together to share ideas and inspire each other. In aerospace, transportation, defence, security and space, our architects design innovative solutions that make our tomorrow's possible. For decades, Ottawa has been a global technology leader. Today, Canada’s capital holds one of the brightest and most diverse technological ecosystems in North America.

Voted as Canada’s best place to live 2017 by Maclean's, Ottawa offers a low cost of living with a high quality of life. The Thales Ottawa office has been a major supplier and long-term trusted partner to DND, enabling the Canadian Armed Forces and the Canadian Coast Guard to achieve mission success. This is a remote and localized role in Ottawa, ON.

• Must be able to monitor and evaluate newly disclosed and emerging vulnerabilities from Thales CTI, OSINT, Thales CERT, PSIRT, vendor advisories, security researchers, vulnerability databases, and other trusted sources.
• Must be able to Initiate and coordinate enterprise vulnerability-response activities for vulnerabilities with potential impact to Thales businesses and networks.
• Must be able to Engage infrastructure, IT, application, cloud, product, and security teams to validate exposure and determine required actions.
• Must have working knowledge of threat actor tactics and techniques.
• Must be able to establish clear ownership, priorities, response timelines, and escalation paths.
• Must be able to track remediation and mitigation activities through completion and validate that identified risk has been appropriately addressed.
• Must be able to escal a missed timelines, unresolved ownership, significant technical uncertainty, or material residual risk to appropriate leadership.
• Must be able to maintain clear status reporting for technical teams, cybersecurity leadership, and other stakeholders.
• Must be able to analyze newly disclosed vulnerabilities to understand affected components, exploitation prerequisites, attack vectors, required privileges, exploitability, potential impact, and available mitigations.
• Must be able to review CVEs, vendor advisories, security-research publications, proof-of-concept information, exploit intelligence, and relevant technical documentation.
• Must be able assess whether vulnerable technologies or configurations are present in the enterprise and partner with technology owners to validate actual exposure.
• Responsible for translating complex vulnerability information into clear, actionable guidance for infrastructure, application, product-development, and leadership teams.
• Responsible for partnering with detection and incident-response teams when a vulnerability requires investigation for possible prior exploitation or additional monitoring.

• Bachelor’s degree in computer information systems, programming, engineering or a related field with a minimum of 5+ years of cybersecurity experience, including at least 3–4 years in vulnerability management, vulnerability analysis, security engineering, incident response, threat intelligence, penetration testing, or a closely related technical security function.
• 5 to 7 years of experience in Cybersecurity domains.
• 3 to 5 years of experience in demonstrated experience analyzing CVEs and determining their relevance and actual impact within complex enterprise environments.
• Strong understanding of vulnerability exploitation, attack paths, operating systems, enterprise applications, networking, authentication, privilege boundaries, and common security controls.
• Ability to interpret vendor advisories, technical security research, proof-of-concept information, logs, configurations, and vulnerability evidence.
• Working knowledge of Windows and Linux environments, network infrastructure, cloud technologies, virtualization, containers, and enterprise applications.
• Ability to independently coordinate urgent, cross-functional technical response activities involving multiple teams and competing priorities.
• Strong organizational skills and the ability…