Cybersecurity Vulnerability Management Analyst (Qualys / Tenable)

Cybersecurity Vulnerability Management Analyst (TVM Analyst)

Location: Brampton, ON – Hybrid (2–3 days per week onsite)

Contract Duration: 6–12 Months

Experience: 6–8 Years

Industry: Cybersecurity / Information Security

Job Overview

• We are seeking an experienced Cybersecurity Vulnerability Management Analyst to support vulnerability assessment, risk prioritization, remediation tracking, and security reporting across enterprise IT environments.
• The ideal candidate will have hands-on experience with vulnerability management platforms such as Qualys VMDR, Tenable/Nessus, or Rapid7 InsightVM, along with strong knowledge of vulnerability lifecycle management, risk assessment, and remediation processes.

Key Responsibilities

• Perform day-to-day vulnerability management activities across infrastructure, endpoints, servers, network devices, applications, and cloud environments.
• Configure, execute, and monitor vulnerability scans using Qualys VMDR, Tenable/Nessus, Rapid7, or equivalent tools.
• Analyze vulnerability scan results, validate findings, identify false positives, and assess associated security risks.
• Prioritize vulnerabilities based on severity, exploitability, asset criticality, exposure, and business impact.
• Collaborate with infrastructure, application, and security teams to coordinate vulnerability remediation.
• Track remediation progress against established SLAs and escalate overdue or high-risk vulnerabilities.
• Support vulnerability exception and risk acceptance processes, maintaining accurate documentation.
• Develop vulnerability management dashboards, security metrics, and executive-level reports.
• Investigate emerging threats, zero-day vulnerabilities, and critical security advisories.
• Identify recurring vulnerabilities, analyze trends, and recommend improvements to reduce overall security exposure.
• Support vulnerability management process improvements, scanning optimization, and automation initiatives.
• Maintain accurate records of assets, vulnerabilities, remediation status, and security exceptions.

Required Skills & Qualifications

• 6–8 years of overall experience in Cybersecurity, Information Security, Vulnerability Management, or a related field.
• Minimum 3+ years of hands-on vulnerability assessment and management experience.
• Practical experience with one or more vulnerability management platforms:
• Qualys VMDR / Qualys Vulnerability Management
• Tenable Vulnerability Management / Nessus
• Rapid7 InsightVM
• Strong understanding of vulnerability assessment methodologies and end-to-end vulnerability lifecycle management.
• Knowledge of CVSS, CVE, CWE, CPE, vulnerability severity classification, and risk-based prioritization.
• Understanding of operating systems, networking, databases, web applications, and enterprise infrastructure.
• Experience analyzing vulnerability findings and recommending appropriate remediation actions.
• Strong knowledge of patch management and vulnerability remediation processes.
• Experience monitoring remediation SLAs, tracking exceptions, and reporting security risks.
• Ability to translate technical vulnerability findings into actionable recommendations.
• Excellent analytical, communication, documentation, and stakeholder-management skills.

Preferred Qualifications

• Experience managing vulnerabilities across on-premises, cloud, and hybrid environments.
• Knowledge of AWS, Azure, or GCP security and cloud vulnerability management.
• Familiarity with CISA Known Exploited Vulnerabilities (KEV), threat intelligence, and actively exploited vulnerabilities.
• Experience developing vulnerability management dashboards, KPIs, and executive reports.
• Exposure to scripting and automation using Python, PowerShell, or similar technologies.
• Experience improving vulnerability scanning coverage and remediation workflows.

Ideal Candidate

• A hands-on Vulnerability Management Analyst with strong experience in Qualys or Tenable, vulnerability risk assessment, remediation coordination, SLA tracking, and cybersecurity reporting within a complex enterprise environment.