Position Title Lead Information Security Analyst, Vulnerability and External Attack Surface Management (T & I) (Telework/Hybrid)

Status of Employment Permanent

Position Language Requirement English, French

Language Skills English (Reading - C - Advanced), English (Speaking - C - Advanced), English (Writing - B - Intermediate), French (Reading - C - Advanced), French (Speaking - C - Advanced), French (Writing - B - Intermediate)

Work at CBC/Radio-Canada At CBC/Radio-Canada, we create content that informs, entertains and connects Canadians on multiple platforms. Our successes and accomplishments are driven by embodying and upholding values, which include creativity, integrity, inclusiveness and relevance.

Do you think you have the ability and drive to keep up with this exciting, ever-changing industry? Whether it be in front of the camera, on air, online or behind the scenes, you would be joining a team that thrives on making connections and telling stories that are key to Canadians.

Behind the scenes, but ahead of the curve: help us develop the next-generation public service media organization. Technology & Infrastructure (T&I;) is the backbone and the future-forward arm of CBC/Radio-Canada. Our purpose is to constantly innovate to evolve and maintain the Corporation’s technology and infrastructure. We are the people that make stuff work. We make connections between media content, systems, people and places. We are the space in between.

A place with purpose. CBC/Radio-Canada has always been a highly regarded pioneer of media technology — not just in Canada but around the world. Today, we are transforming ourselves into a modern and agile public service media organization. Technology is the driving force, and we are the team making it happen.

This is a hybrid role with a mix of in-office and remote work. Work arrangements will be discussed with hiring managers per departmental guidelines. Your Role CBC/Radio-Canada is seeking a Lead Analyst, Vulnerability and External Attack Surface Management, to optimize the Corporation’s vulnerability management program and design, build and deploy its external attack surface management (EASM) service.

In this role, you will take strategic and operational ownership of this domain. You will establish a comprehensive map of the Corporation’s external digital footprint — including internet-exposed assets, domains, certificates, cloud accounts, public APIs and exposed data — while driving continuous improvements to internal and hybrid vulnerability management. As a recognized subject matter expert, you will serve as a technical authority for leadership, maintain the vulnerability and exposure risk register, and adjudicate security exemption requests across the organization.

This position can be based in Montreal or Toronto. What’s In It For You Challenges. We spend our days solving problems of all kinds. Media files are highly nuanced and incredibly complicated; updating, installing and supporting technologies that are organization-wide and that impact broadcasting content is a time-sensitive, complex technical feat. And that’s just the beginning. You’ll be working with leading-edge data management, cloud, IP broadcasting, AI, security and reliability technologies.

As Lead Analyst, you will:

Map the digital footprint: Identify, classify and inventory CBC/Radio-Canada’s complete external attack surface for the first time, establishing the baseline for domain names, subdomains, public IP address ranges, exposed services, public cloud environments and APIs.

Implement continuous detection: Develop and execute procedures to detect inadvertently exposed services, expired or vulnerable certificates and leaked credentials or source code on the public web.

Lead the vulnerability life cycle: Define and optimize end-to-end processes for vulnerability detection, triage, impact analysis, prioritization, remediation and verification.

Define the scanning strategy: Establish the scope and frequency of automated and manual vulnerability scans across the entire IT environment.

Assess risk in context: Evaluate discovered vulnerabilities by cross-referencing CVSS scores with business context, asset criticality, existing compensating controls and active threat intelligence (e.g., known exploits).

Develop remediation plans: Recommend targeted corrective measures — such as patch management, system reconfigurations, temporary workarounds or WAF/firewall rules — for internal teams.

Lead zero-day response: Provide technical leadership during critical zero-day vulnerabilities and incidents (e.g., Log4j, major OS/hardware flaws), co-ordinating rapid detection and mitigation.

Evaluate and adjudicate security exemptions: Conduct in-depth technical reviews of exemption requests when prescribed patching or remediation timelines cannot be met. A

📌 Lead Information Security Analyst, Vulnerability and External Attack Surface Management (Canada)
🏢 CBC / Radio-Canada
📍 Canada