Senior Vulnerability Management Specialist

Supports the full cycle of vulnerability management from discovery/asset identification through risk assessment, remediation, verification, and reporting. Works with Information Security, Information Technology, engineering, and other technical and product/operational stakeholders to ensure understanding of and commitment to relevant vulnerability standards and practices. Proactively monitors system, network, and other changes to ensure their inclusion in vulnerability assessment/remediation activity.

• Performs Cybersecurity and compliance assessments on new and existing systems, processes and technologies.
• Conducts system scans, access and firewall reviews, and audit research.
• Transforms, analyzes, prioritizes, and distributes findings to stakeholders.
• Coordinates, tracks, and escalates remediation and mitigation efforts with application and infrastructure owners.
• Participates in emergency and crisis management exercises/response.
• Helps with the proactive planning and design of procedural and technical measures to protect against current and future threats.
• Creates comprehensive assessment reports defining existing vulnerabilities, average time to remediation, compensating controls, work in progress and a roadmap for vulnerability remediation.

Required Qualifications

• Diploma or equivalent work experience required.
• Minimum of 5-7 years of relevant experience or equivalent combination of education and experience in Vulnerability Management.
• Good business English skills (Written and spoken).
• Excellent business English and communication skills (Written and spoken).

• Ability to influence behavior and outcomes via tactful, yet assertive, communication with colleagues.

• Administrative and/or integration knowledge of scanning and ticketing systems such as Tenable and ServiceNow.

• Working competence with Office, especially Outlook and Excel, including formulas.

  Preferred Qualifications

• Good knowledge of Threat Intelligence collection, dissemination, analysis and delivery.
• Good knowledge of multiple security and privacy concepts such as: OSINT, HUMINT, SOCMINT, NIST, PCI, GDPR.
• GCIA, GHIH, CEH, or CISSP Certification.
• Good knowledge of ISO 9001 Quality management system.
• Good knowledge of ISO 20000 information technology service management (ITSM) system.
• Good knowledge of other security frameworks such as COBIT, PCI DSS, NIST and SSAE16 is advantage.
• Good knowledge of Security Regulations (SOX, PCI, GLBA) is an advantage.
• Good knowledge of ISO 31000:2009 Risk Management.

• Knowledge of Windows OS, Linux OS and/or general application patching, configuration, or upgrade.

• DOD ACAS, HBSS training