Job Description

As a Vulnerability Remediation Engineer within the global Security, Compliance & Observability department in Technology Platform Engineering & Operations organisation, you will directly contribute to and improve the delivery of a Security Product to satisfy customer needs, regulatory requirements and drive the innovation within relevant people, process and technology areas.

This role reports to Security Engineering Manager - Vulnerability Remediation and has a unique opportunity to shape the future of an enterprise-wide vulnerability management programme in a very large, heterogenous environment comprising of hundreds of thousands of IT assets across on-prem and cloud in a leading financial services company with $40T+ of assets under custody. As a Subject Matter Expert in infrastructure vulnerability management area, you will work with people, process and technology to actively reduce the cyber risk to the estate, following the priorities set by Global Cybersecurity, Internal Audit and Regulators, configure and maintain necessary tooling as well as develop automation and orchestration to increase remediation velocity, improve reporting or any other relevant area through the use of scripting languages and APIs.

We offer flexible working and remote working options and don’t expect you to be in the office 5 days a week, but can if that is what you prefer. Upon submission and acceptance of your CV we will look to communicate with you quickly and recruit via a panel, which if you’re right, the job offer will come quickly. We realise that waiting or never getting a response is not a wanted part of applying for a new job.

 What you’ll do:

• work with stakeholders from Cybersecurity, IT and Business to coordinate and drive vulnerability remediation activities, escalations, risk acceptance/exclusion and false positive submission
• support the remediation of relevant cyber risks identified by Corporate Audit, Technology Risk Management and Regulators
• onboard, configure and operate tooling related to vulnerability management, patch management, IT asset management and ticketing
• create and maintain on-prem and cloud infrastructure supporting the enterprise vulnerability management programme
• automate and orchestrate vulnerability management tooling through scripting and APIs
• monitor various threat intelligence sources (internal and external) and stay on the top of the current vulnerability landscape
• create and maintain necessary Product documentation
• partner with GRC, IT Asset Management and any other teams to identify and close process and documentation gaps
• create reports, presentations, dashboards related to the current state of and progress on vulnerability remediation

Who you are:

• Bachelor degree in Cybersecurity, Computer Science, Telecommunications or similar area

• minimum 5 years of overall industry experience in Cybersecurity, preferably in Vulnerability Management or Patch Management
• good understanding of and previous hands-on experience in any of the following: TCP/IP, Operating Systems, servers, databases, network devices, web applications, cloud, virtualization, system administration
• extensive experience working with tools like e.g. Qualys VMDR, Tenable.io/Nessus, Rapid7, Tanium, SCCM, IBM BigFix, ServiceNow, Kenna Security, Vulcan Cyber, Veracode, Sonarqube, Qualys WAS, RSA Archer, WSUS, Black Duck, Splunk
• understanding of concepts related to modern, risk-based vulnerability management and broader information security concepts
• experience working with large data sets
• demonstrated scripting or other automation capabilities in Powershell, Python, Bash, REST APIs
• strong commitment to continuous process improvement and process automation
• good communication and negotiation skills with ability to move from technical jargon to business language, depending on the target audience
• understanding of and experience working with Atlassian tools (JIRA, Confluence)
• experience in working with Git would be considered a plus
• understanding of IT Service Management processes and frameworks and experience in working with tools relevant to this area would be considered a plus
• industry certifications like CISSP, CISM, Security+, OSCP, CCNA Security, ITIL etc. would be considered a plus