Key Responsibilities:
- Own and manage the end-to-end vulnerability management lifecycle, from identification and validation through remediation and closure.
- Perform hands-on vulnerability assessments across infrastructure, endpoints, cloud environments, networks, and applications.
- Analyze and validate vulnerability scan results, including identifying false positives and determining actual exposure.
- Perform risk-based vulnerability prioritization considering factors beyond CVSS/severity, including asset criticality, business impact, exploitability, exposure, and active exploitation.
- Investigate vulnerabilities across Windows and Linux environments and coordinate appropriate remediation activities.
- Assess security vulnerabilities across cloud and endpoint environments.
- Define technical remediation and mitigation steps and work with relevant teams to implement them.
- Document technical findings, evidence, risk, business impact, and recommended remediation actions.
- Drive vulnerability remediation across Infrastructure, Cloud, Network, Application, DevOps, and Security teams.
- Track remediation progress and ensure vulnerabilities are addressed within defined remediation SLAs.
- Perform remediation validation through re-scanning, technical verification, or other appropriate methods.
- Support endpoint security and vulnerability management activities using relevant security platforms.
- Maintain the vulnerability dashboards, reports, remediation status, and risk documentation.
- Provide regular updates to security and business stakeholders regarding critical findings, remediation progress, exceptions, and outstanding risks.
- Support investigation and response activities for critical or actively exploited vulnerabilities, including zero-day vulnerabilities when required.
Required Qualifications:
- 5+ years of experience in Vulnerability Management, Security Operations, Cybersecurity, or a related security domain.
- Hands-on experience in vulnerability assessment and vulnerability management.
- Strong understanding of risk assessment and risk-based vulnerability prioritization, beyond simply relying on CVSS/severity ratings.
- Ability to analyze, investigate, and validate vulnerability scan results.
- Strong knowledge of endpoint security and vulnerability remediation.
- Good understanding of Windows and Linux operating systems from a security perspective.
- Working knowledge of networking and network security fundamentals.
- Understanding basic application security and common application vulnerabilities.
Experience working with some of the following security technologies/tools:
- Wiz
- CrowdStrike
- Nexpose / Rapid7
- Splunk
- AppSpider
- ServiceNow
Ability to document technical security findings and define appropriate remediation/mitigation steps.
Demonstrated experience driving remediation activities across multiple technical teams.
Strong communication, stakeholder management, ownership, and follow-up skills.
Preferred Qualifications:
- Experience in Security Operations (SecOps) and/or Vulnerability Management.
- Exposure in security environments across AWS, Microsoft Azure, and Google Cloud Platform (GCP).
- Experience with zero-day vulnerability identification, assessment, response, and remediation.
- Experience working with remediation SLAs and vulnerability tracking.
- Familiarity with security exceptions, risk acceptance, compensating controls, and risk treatment processes.
- Experience coordinating remediation across infrastructure, cloud, network, application, and DevOps teams.
Relevant security certifications such as:
- CompTIA Security+
- CompTIA CySA+
- GIAC Security Essentials (GSEC)
