Vulnerability Management Specialist

About Kinaxis

Are you looking to join an innovative, market-leading company where you can truly elevate your career? At Kinaxis we are serious about culture, we are serious about technology, we are serious about customers, and we are serious about not taking ourselves too seriously. If you are looking to be part of an incredible growth story, then we might just be the place for you!

In 1984, we started out as a team of three engineers. Today, we have grown to become a global organization with over 2000 employees around the world, 6 global office and a best-in-class HQ in Ottawa, Canada. As winners of several Top Employer awards globally, we are proud to work with our customers and employees towards solving some of the biggest challenges facing supply chains today.

Kinaxis is a global leader in modern supply chain orchestration, powering complex global supply chains, and supporting the people who manage them. Our powerful, AI infused platform provides full transparency and visibility across end-to-end supply chains, enabling our customers to make faster, better decisions. We are trusted by renowned global brands to provide the agility and predictability needed to navigate today’s volatility and disruption. With more than 40,000 users in over 100 countries, we are expanding our team as we continue to innovate and revolutionize how we support our customers.

Location

Ottawa and Toronto, CA - Hybrid

Other Canadian locations - Remote

About the role

The Vulnerability Management Specialist, as a proficient-level professional with well-defined experience, will be primarily responsible for the enterprise Vulnerability Management program, ensuring that vulnerabilities across Kinaxis assets are discovered, prioritized by risk and remediated in a timely manner, as part of a global Security team that is responsible for all security-related handling for Kinaxis Corporate and Kinaxis RapidResponse Software-as-a-Service.

The incumbent will administer and continuously tune the vulnerability management platform, translate threat intelligence and vendor advisories into actionable, risk-based priorities, and drive remediation through strong coordination and clear guidance. This person will interface with cross functional teams within Kinaxis such as Corporate IT, SaaS Operations, Cloud Platform Engineering, Product Development, Business Systems teams, Customer Success, and Technology partners to reduce the organization’s attack surface and maintain company-wide information security.

Vacancy Status

This is an existing job vacancy

What you will do

Vulnerability Management Platform and Scanning

• Administer, configure and continuously tune the enterprise vulnerability management platform (scanners, agents, credentials, scan policies, asset tagging and integrations) to ensure complete and accurate coverage of assets across Kinaxis Corporate and SaaS environments.

• Measure and close asset coverage gaps by reconciling the platform against authoritative asset sources (CMDB, cloud inventories, EDR) and onboarding new environments as they are introduced.

• Automate and maintain scheduled vulnerability scans, and run on-demand scans in response to threat intelligence, zero-day disclosures or vendor security advisories.

• Manage the relationship with the vulnerability management platform vendor, holding regular check-ins, conducting periodic platform health checks, tracking support cases and evaluating new capabilities.

Threat Intelligence and Risk-Based Prioritization

• Review threat intelligence feeds and vendor advisories for applicability, and triage the impact of newly disclosed vulnerabilities on Kinaxis systems and services.

• Apply risk-based vulnerability management to prioritize remediation using exploitability (e.g., CISA KEV, EPSS), CVSS severity, asset criticality, exposure and business context.

Remediation Coordination and Risk Mitigation

• Coordinate vulnerability remediation with remediation teams (Corporate IT, Cloud Services and Product teams), tracking tickets through to closure against defined SLAs.

• Provide clear and concise remediation guidance, including patches, configuration changes, compensating controls and other risk mitigation options, tailored to each remediation team.

• Set up and lead regular meetings with remediation teams to review and discuss vulnerability backlogs, overdue items, blockers and risk exceptions.

• Coordinate with other members of the Security team to mitigate risks resulting from vulnerabilities, including the response to critical and actively exploited vulnerabilities.

Reporting, Documentation and Continuous Improvement

• Produce quarterly vulnerability management reports showing key metrics, including asset coverage, prioritized tickets, vulnerability remediation velocity, vulnerability age and SLA compliance.

• Develop and maintain vulnerability management procedures, runbooks and standards, including scanning schedules, remediation SLAs, exception handling and escalation paths.

• Design and operate approved AI-assisted workflows for vulnerability enrichment, clustering, prioritization, remediation guidance and reporting, validating AI output against authoritative vulnerability, asset and threat sources and applying human review, traceability, least-privilege and sensitive-data controls.

• Measure the value of AI assistance (e.g., false-positive reduction, analyst rework, data completeness, remediation cycle efficiency) and assess vulnerabilities and attack-surface risks introduced by enterprise generative and agentic AI services within the role’s approved scope.
• Respond to customer enquiries about vulnerabilities discovered on Kinaxis services, providing accurate, timely and approved responses in coordination with other relevant teams.

What we are looking for

• Bachelor’s degree in Information Security, Computer Science, Information Management Systems, or similar, or equivalent experience.

• 3-5 years of experience in IT Operations, IT Security, or similar; high-tech, global organization is preferred (minimum of 2 years’ hands-on experience in enterprise vulnerability management).

• Industry certifications such as CompTIA Security+, CompTIA CySA+, or GIAC (e.g., GEVA, GCED); see Role Specific Skills, Experience and Industry Certifications below.

• Understanding of relevant governance and control frameworks and standards related to vulnerability management (e.g., NIST CSF, NIST SP 800-40, NIST SP 800-53, ISO 27000 Series, CIS Controls, SOC 1/2, PCI-DSS, FedRAMP) is preferred.

• A clear, concise, and professional communicator with the ability to explain technical vulnerability risk and remediation guidance to engineers, service owners, customers and leadership.

#Intermediate

Work With Impact: Our platform directly helps companies power the world’s supply chains. We see the results of what we do out in the world every day, when we see store shelves stocked, when medications are available for our loved ones, and so much more.

Work with Fortune 500 Brands: Companies across industries trust us to help them take control of their integrated business planning and digital supply chain. Some of our customers include Lockheed Martin, Unilever, P&G, ExxonMobil, Cisco and more.

Social Responsibility at Kinaxis: Our Diversity, Equity, and Inclusion Committee weighs in on hiring practices, talent assessment training materials, and mandatory training on unconscious bias and inclusion fundamentals. Sustainability is key to what we do and we’re committed to a long-term net-zero operations strategy. We are involved in our communities and support causes where we can make the most impact.

People matter at Kinaxis and here are some of the perks and benefits we offer, which may vary by location and employee:

• Flexible vacation and Kinaxis Days (company-wide days off)
• Flexible work options
• Physical and mental well-being programs
• Regularly scheduled virtual fitness classes
• Mentorship programs, training, and career development
• Recognition programs and referral rewards
• Hackathons

For more information, visit the Kinaxis website at www.kinaxis.com or the company’s blog at http://blog.kinaxis.com.

Kinaxis welcomes candidates to apply to our inclusive community. We provide accommodations upon request to ensure fairness and accessibility throughout our recruitment process for all candidates, including those with specific needs or disabilities. If you require an accommodation, please reach out to us at [email protected]. This contact information is for accessibility requests only and cannot be used to inquire about the status of applications.

Kinaxis is committed to ensuring a fair and transparent recruitment process. We use artificial intelligence (AI) tools in the initial step of the recruitment process to compare submitted resumes against the job description to identify candidates whose education, experience, and skills most closely match the requirements of the role. After the initial screening, all subsequent decisions regarding your application, including final selection, are made by our human recruitment team. AI does not make any final hiring decisions.