IT Security Officer – Vulnerability & Risk Management

Role Overview

We are looking for an IT Security Officer specializing in Vulnerability Management and IT Risk Management to support a hybrid on-premises and AWS environment.

The role will own the vulnerability management lifecycle, maintain the IT Risk Register, drive remediation and risk acceptance activities, and provide risk-based recommendations to technical and business stakeholders.

Key Responsibilities

• Manage the end-to-end vulnerability management lifecycle across on-premises and AWS environments.
• Run and manage vulnerability scans using tools such as Tenable/Nessus, Qualys or Rapid7.
• Review vulnerability findings, assess their impact and prioritize remediation based on CVSS and business/technical context.
• Track remediation activities with infrastructure and application SMEs and escalate overdue vulnerabilities.
• Maintain the IT Risk Register and ensure risks, owners, treatment plans and status are current.
• Prepare and coordinate Risk Acceptance for vulnerabilities or risks that cannot be remediated within the required timeframe.
• Work with technical and business stakeholders to obtain risk acceptance approvals and periodically review accepted risks.
• Review vendor security advisories and determine their applicability and potential impact to the environment.
• Monitor security-update compliance for AV/EDR, IDS/IPS and similar security controls.
• Prepare vulnerability and risk management dashboards/status reports for management.
• Work across Security, Infrastructure, Cloud and Application teams to drive remediation and risk reduction.

Required Skills

• 3–5+ years of experience in Vulnerability Management, IT Security or Risk Management.
• Hands-on experience with Tenable/Nessus, Qualys, Rapid7 or equivalent vulnerability scanning tools.
• Strong understanding of CVSS and risk-based vulnerability prioritization.
• Practical experience managing Risk Registers and Risk Acceptance processes.
• Strong experience in vulnerability remediation tracking and coordination with technical SMEs.
• Good understanding of on-premises infrastructure security covering servers, network devices and endpoints.
• Working knowledge of AWS security and the shared responsibility model, particularly EC2, S3, RDS, IAM and services such as Security Hub, GuardDuty and Inspector.
• Strong stakeholder management and communication skills.

Preferred

• Experience with GRC tools such as ServiceNow GRC or RSA Archer.
• Knowledge of NIST CSF, NIST 800-53 or ISO 27001.
• Relevant certifications such as Security+, CySA+, CISSP, CRISC or AWS Security Specialty.
• Experience supporting security/risk management in a hybrid cloud environment or managed-services/customer environment.