Senior Cybersecurity Specialist Vulnerability Management

A career at TransLink and our family of companies means working with people with a wide range of skills and perspectives, all teaming up towards a common goal: preserving and enhancing the region's world-envied quality of life. Together, we connect the region and enhance its livability by providing a sustainable transit and transportation network, embraced by our communities and people.
At TransLink we are dedicated to building a workforce that reflects the diversity of the communities in which we live. We’re committed to fostering an inclusive, equitable and accessible workplace, recognizing the unique value and skills every individual brings.
Looking for a great place to work where your contributions are valued and you can make a difference in a vibrant city? At TransLink, one of BC’s Top Employers, you'll help make Metro Vancouver a better place to live, built on transportation excellence. Put your future in motion!
ResponsibilitiesPRIMARY PURPOSE
In accordance with TransLink's vision, values and established supporting policies and standards, the Senior Cybersecurity specialist, Vulnerability Management is a resourceful and forward-thinking subject matter expert, providing senior level of guidance and leads the TransLink’s overall vulnerability management program. This includes collaborating with peers and leadership in different decision centers to ensure risk reduction through timely vulnerability remediation. Assesses TransLink’s systems and infrastructure within the network environment or enclaves to identify deviations from acceptable patching practices, hardening and configurations as required through applicable policies and standards. The role involves taking ownership and leading vulnerability management activities through assessing, triaging, prioritization, reporting and streamlining the vulnerability management process to facilitate timely risk-based remediation. This role will also lead the development and presentation of key metrics, updates, findings, and other relevant program information to senior management and key stakeholders for informed decision making.
Key AccountabilitiesActs as a primary technical lead for TransLink’s Vulnerability Management practices, maintains current configurations, procedures, and documentation. Provides senior level of recommendation and leads the implementation of vulnerability discovery system enhancements to improve its performance and reliability.
Leads the information security vulnerability management program to reduce risk and meet program’s SLA’s and KPI’s.
Leads & supports the development and maintenance of an end-to-end Vulnerability Management process, including reporting, metrics, escalation of critical vulnerabilities and risks, and assessing patching/remediation efforts to ensure they meet compliance requirements and TransLink Security Policy and standards.
Leads the analysis in determining, and fulfilling patching requirements for each environment, including identifying critical vulnerabilities and patches from external sources and applications, and enable timely remediation of those vulnerabilities.
Collaborates with stakeholders and senior leaders and leads the development of short-term and long-term plans, policies, strategies, and roadmaps for vulnerability management and ensure timely updates as and when required.
Develops, manages, measures, and reports key compliance and response time metrics that measure the effectiveness of TransLink’s vulnerability management practices. Develops and maintains methods and procedures for consistent tracking and review of open vulnerabilities using a risk-based approach. Provides support and metrics to senior management on matters related to Vulnerability Management program.
Provides senior level of technical guidance collaboratively to peers in both IT and information security on vulnerability remediation.
Partners with IT and business teams across the organization and service providers to map, track, monitor and communicate progress on vulnerability remediation activities. Builds strong partnerships with technical teams to promote best practices for managing vulnerabilities. Anticipates and plans for future risk in meeting vulnerability SLA’s. Coordinates and communicate with internal partners across the IT department.
Keeps abreast and analysis of known and emerging threats and vulnerabilities to identify risks that could have impact to TransLink IT environment.
Participates in collecting, assessing, and cataloging threat indicators related to vulnerability management. Facilitates out-of-band patching and Zero Day deployments. Identifies gaps and support action plans to strengthen Vulnerability Management control efficiency.
Provides ongoing reporting of patch status as required for all recurring and non-recurring efforts. Assists with the creation and/or maintenance of operational security metrics with dashboards and reports. Drives actionable metrics, prioritization and reporting for operations and leadership transparency and informed decision making.
QualificationsEducation and ExperienceThe competencies of this position would be acquired through completion of a university degree in Computer Science or
equivalent discipline plus (6) six years of experience in system security, vulnerability management and patch deployment tools within large enterprise infrastructures. Certifications in vulnerability assessment and penetration testing as GSEC or CEH, or equivalent technical experience. Certifications, such as CISSP, CRISC, CISM, CIPP and relevant other GIAC certifications, are desirable.
Other RequirementsExperience working with information security platforms: Vulnerability Scanners, Exploitation tools, SIEM.
Strong knowledge and experience with Windows operating systems security controls, Active Directory security best practice, PKI security concepts and networking security controls.
Strong knowledge of information security metrics and reporting.
Strong knowledge of Web, API, Application and Database security and vulnerabilities.
Strong knowledge of information security frameworks, standards and regulations related to data privacy and security.
Strong knowledge of ethical hacking principles and techniques including the MITRE ATT&CK framework.
Strong knowledge of cyber-attack stages (e.G., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
Experience with IT Infrastructure vulnerability management concept and patch assessment.
Experience with performing technical vulnerability assessments, penetration tests and Red’ team exercises.
Ability to identify/describe target vulnerabilities.
Ability to communicate complex information, concepts, risks, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
Ability to identify/describe techniques/methods for conducting technical exploitation of the target.
Ability to evaluate, analyze, and synthesize large quantities of data (which may be fragmented and contradictory) into high quality, fused targeting/intelligence analysis report.
Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.
Ability to communicate effectively at all levels of the organization, with internal or external teams, in well-structured written reports and oral format.
Ability to interact with other security and infrastructure teams to assess potential impact from vulnerabilities including but not limited to (security architecture, penetration testing, application development, internal audit).
Ability to manage relationships at all levels with end users, managements, vendors, and team members to effect change.
Excellent organizational skills with the ability to prioritize items.
Other InformationThis is a senior-level opportunity for an experienced cybersecurity professional who thrives on taking ownership of complex vulnerability challenges and driving them through to resolution. The role works closely with BTS technical teams;
other responsibilities include:
Independently own vulnerability investigations from identification through other BTS team's remediation and closure.
Prioritize vulnerabilities based on exploitability, asset criticality, exposure, and business impact.
Lead remediation progress of critical and zero-day vulnerabilities across other technical teams in BTS.
Validate vulnerability findings and identify false positives before escalation.
Communicate vulnerability risks and remediation priorities clearly to BTS operation technical and executive management teams.
Work Schedule37.5 hours per week.
Work DesignationHybrid
This position offers the flexibility of working both on-site and remotely within B.C.
Rate of PayThe salary for this position ranges from $100,080 - $150,120 per annum. Actual salary offered will be based on education, experience, skills, and qualifications as they relate to the role.
We aim to provide competitive pay that reflects your professional background and expertise. We want to ensure our offer will align with your strengths considering experience, skills, and internal equity to offer a fair and equitable salary. The Total Compensation Package, which includes Extended Health, Dental, Transit Pass and enrollment in the Public Service Pension Plan as well as other employment offerings will be discussed in detail as your application progresses.
TransLink is committed to employment equity and building a diverse workforce, representative of the customers we serve and the many communities in the Metro Vancouver region. We welcome and encourage Indigenous applicants, people of colour, all genders, 2SLGBTQ+ and persons with disabilities to apply. Learn more about TransLink's commitment to equity, diversity and inclusion.
Accommodations are available on request for candidates taking part in all aspects of the selection process. For a confidential inquiry, simply email us at View email address on ca.hrm.tc.
#J-18808-Ljbffr