[Hiring] Cybersecurity Vulnerability Engineer @Thales

Role Description

This position is responsible for providing ongoing information security services to all aspects of the on-premise and cloud corporate IT environments. The Cybersecurity Vulnerability Engineer will require working across several security functions and have a strong primary focus on incident response activities.

Key Areas of Responsibility

• Must be able to monitor and evaluate newly disclosed and emerging vulnerabilities from Thales CTI, OSINT, Thales CERT, PSIRT, vendor advisories, security researchers, vulnerability databases, and other trusted sources.
• Must be able to initiate and coordinate enterprise vulnerability-response activities for vulnerabilities with potential impact to Thales businesses and networks.
• Must be able to engage infrastructure, IT, application, cloud, product, and security teams to validate exposure and determine required actions.
• Must have working knowledge of threat actor tactics and techniques.
• Must be able to establish clear ownership, priorities, response timelines, and escalation paths.
• Must be able to track remediation and mitigation activities through completion and validate that identified risk has been appropriately addressed.
• Must be able to escalate missed timelines, unresolved ownership, significant technical uncertainty, or material residual risk to appropriate leadership.
• Must be able to maintain clear status reporting for technical teams, cybersecurity leadership, and other stakeholders.
• Must be able to analyze newly disclosed vulnerabilities to understand affected components, exploitation prerequisites, attack vectors, required privileges, exploitability, potential impact, and available mitigations.
• Must be able to review CVEs, vendor advisories, security-research publications, proof-of-concept information, exploit intelligence, and relevant technical documentation.
• Must be able to assess whether vulnerable technologies or configurations are present in the enterprise and partner with technology owners to validate actual exposure.
• Responsible for translating complex vulnerability information into clear, actionable guidance for infrastructure, application, product-development, and leadership teams.
• Responsible for partnering with detection and incident-response teams when a vulnerability requires investigation for possible prior exploitation or additional monitoring.

Qualifications

• Bachelor’s degree in computer information systems, programming, engineering or a related field with a minimum of 5+ years of cybersecurity experience, including at least 3–4 years in vulnerability management, vulnerability analysis, security engineering, incident response, threat intelligence, penetration testing, or a closely related technical security function.
• 5 to 7 years of experience in Cybersecurity domains.
• 3 to 5 years of demonstrated experience analyzing CVEs and determining their relevance and actual impact within complex enterprise environments.
• Strong understanding of vulnerability exploitation, attack paths, operating systems, enterprise applications, networking, authentication, privilege boundaries, and common security controls.
• Ability to interpret vendor advisories, technical security research, proof-of-concept information, logs, configurations, and vulnerability evidence.
• Working knowledge of Windows and Linux environments, network infrastructure, cloud technologies, virtualization, containers, and enterprise applications.
• Ability to independently coordinate urgent, cross-functional technical response activities involving multiple teams and competing priorities.
• Strong organizational skills and the ability to track multiple concurrent vulnerability-response activities through closure.

Preferred Qualifications

• Strong knowledge of all aspects of information security within the Prevent, Detect and Respond domains.
• Must be highly analytical and detail-oriented, with organizational skills to manage assigned work to completion.
• Experience supporting large, complex, or globally distributed enterprise environments.
• Experience working across corporate IT, shared infrastructure, software-development, cloud, and product environments.
• Experience using scripting or automation with Python, PowerShell, APIs, SQL, or similar technologies to support vulnerability analysis and data correlation.

Requirements

• Typical Office environment.
• Schedule: First Shift Monday through Friday; Core Business Hours Monday-Friday.
• Access to Trade Controlled Hardware, Software, Technical Information, Controlled Goods Program Clearance & Secret Security Clearance.

Benefits

• Company paid Extended Health, Dental, HSA, Life, AD&D, Short-term Disability, Cancer Care Program, travel insurance, Employee Assistance Plan and Well-Being program.
• Retirement Savings Plans (RRSP, DCPP, TFSA) with a company contribution and a match to a DCPP, with no vesting period.
• Company paid holidays, vacation days, and paid sick leave.
• Voluntary Life, AD&D, Critical Illness, Long-Term Disability.
• Employee Discounts on home, auto, and gym membership.