Scotiabank
At a Glance
Requisition ID: 276026
Employee Referral Program – Potential Reward: $200.00
We are committed to investing in our employees and helping you continue your career at ScotiaTech.
Purpose
As part of Scotiabank's Cyber Security Operations (CSOps), the Enterprise Vulnerability Management (EVM) Program supports the identification, prioritization, communication, tracking, escalation, and reporting of vulnerability exposure across the Bank's technology environment. EVM Operations works with application, infrastructure, penetration testing, scanning, and technology teams to drive vulnerabilities through treatment and validation within established remediation expectations.
The remediation function supports recurring vulnerability-management operations across infrastructure, web application security, penetration testing, and priority vulnerability processes. The team uses enterprise vulnerability data, risk scoring, ticketing and ServiceNow workflows, dashboards, and stakeholder communications to maintain visibility of remediation progress and support timely closure.
Accountabilities:
The Vulnerability Remediation Associate is responsible for supporting the day-to-day execution of EVM vulnerability remediation activities. Working under the direction of senior EVM remediation staff, the Associate reviews assigned vulnerability findings, validates key asset and ownership information, communicates with remediation owners, tracks remediation plans and target dates, follows up on outstanding actions, and maintains accurate ticket and status information.
The role supports Zero Tolerance and other prioritized vulnerability workflows by monitoring assigned findings, coordinating acknowledgement and remediation updates, supporting rescan or retest validation, documenting evidence and status, and escalating unresolved issues through the established EVM process. The Associate also supports operational reporting, data-quality follow-up, dashboard and ticket reconciliation, and EVM workflows in Jira and ServiceNow USEM.
Try again
Retrying...
Retrying...
• Experience or foundational knowledge in vulnerability management, cybersecurity operations, technology risk, infrastructure, application security, or a related discipline.
• Ability to review vulnerability findings from infrastructure scanning, web application security, and penetration-testing sources and accurately document remediation status.
• Experience supporting remediation tracking, ticket management, action follow-up, or operational case management using tools such as Jira and ServiceNow.
• Ability to coordinate with application owners, infrastructure teams, security teams, and technology stakeholders to obtain remediation plans, target dates, change references, and evidence.
• Ability to monitor assigned vulnerabilities against remediation targets and raise potential breaches, stalled remediation, missing ownership, or unresolved dependencies through established escalation channels.
• Ability to support validation using scan results, rescans, retests, or other approved remediation evidence and maintain complete closure records.
• Working knowledge of CVEs, severity, CVSS, risk scoring, internet exposure, asset criticality, compensating controls, remediation, exceptions, and false positives.
• Ability to identify data-quality issues involving asset information, application ownership, assignment, vulnerability status, or risk-scoring inputs and document them for follow-up.
• Strong written communication skills for remediation notices, follow-ups, ticket notes, operational summaries, and escalation updates.
• Strong attention to detail when reviewing vulnerability records, ticket fields, status changes, ownership information, and remediation evidence.
• Ability to use dashboards, spreadsheets, ticket queues, and operational reports to reconcile vulnerability and remediation information.
• Working knowledge of Microsoft 365 tools including Excel, Outlook, Teams, Word, and SharePoint.
• Familiarity with Tenable, ServiceNow Vulnerability Response / USEM, Jira, Power BI, or comparable tools is an asset.
• Relevant cybersecurity or technology certifications and post-secondary education in cybersecurity, information technology, computer science, or a related discipline are considered assets
Location(s): Colombia : Bogota : Bogota
ScotiaTech is a business unit within ScotiaGBS, a Scotiabank Group company located in Bogota, Colombia. The ScotiaTech hub was created to support different technology systems and processes of the Bank. We offer an inclusive, positive work environment, and competitive benefits.
At ScotiaTech, we value the unique skills and experiences each individual brings and are committed to creating and maintaining an inclusive and accessible environment for everyone. Candidates must apply directly online to be considered for this role. We thank all applicants for their interest in a career at ScotiaTech; however, only those candidates who are selected for an interview will be contacted.
Job Segment:
Cyber Security, Computer Science, Bank, Banking, Sharepoint, Security, Technology, Finance
Source: Scotiabank careers · View original posting
Scotiabank, officially known as The Bank of Nova Scotia, is a prominent global financial services provider founded in 1832 in Halifax, Nova Scotia, Canada. The bank operates in personal, commercial, corporate, and investment banking, offering a wide range of financial products and services, including financial advice, banking solutions, lending, deposit accounts, cash management, trade finance, and wealth management. With a rich history of expansion, Scotiabank has grown to become one of Canada's largest banks, with a significant international presence. It serves a diverse customer base, including retail clients, small businesses, and large corporations, through an extensive network of branches, ATMs, and digital platforms. The bank has a strong presence in North America, the Caribbean, Central and South America, and operations in Europe, Asia, and Australia, with key markets in Mexico, Peru, Chile, Colombia, and Uruguay. Headquartered in Toronto, Scotiabank is recognized for its commitment to innovation and customer service excellence.
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
Security Team
Scotiabank's Application Security Operation team has global accountability, with an operational team responsible for integrating both application and cloud-native security practices. Key public-facing leaders include Jeff Ponte, Senior Manager Application Security and CNAPP Operations, who leads the operational team, and Neha Mudalgikar, Managing Director, Cyber & IT Risk, who leads global technology engagements requiring formulation of InfoSec strategies. A team size estimate is not publicly available. As of, one AppSec-specific job posting was found (AppSec and CNAPP Operation Analyst), with related security/cloud postings also identified. Common skill and tool patterns mentioned in job postings and profiles include SAST, SCA, DAST, CNAPP, Container Security, Agile, DevSecOps, and other secure SDLC methodologies. A consolidated public list of specific tool vendors is not publicly available.
Key Initiatives
No public evidence was found for a Security Champions Program. "Shift Left"practices are evident through working closely with application development groups to integrate AppSec and CNAPP processes, and championing shift-left testing, CI/CD integration, and test-driven development practices. The Vulnerability Management Process includes an intake mechanism via a responsible disclosure program, and triage/remediation involves managing the triage of findings and streamlining reporting and metrics. Explicit SLAs, MTTR targets, ticketing systems, and remediation ownership directives are not publicly available. Secure SDLC Artifacts involve utilizing Agile, DevSecOps, and other secure SDLC methodologies, and integrating AppSec and CNAPP processes with development groups. Explicit public descriptions of mandatory security review gates, threat modeling schedules, or official secure-by-design checklist documents are not publicly available. Recent initiatives (last 6 months) show an expansion to CNAPP and cloud-native coverage. Information on program launch dates, adoption metrics, or tool rollout timelines for CNAPP is not publicly available.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on Scotiabank's site