Vulnerability Management Expert – Patch Orchestration Team

Brak informacji o wynagrodzeniu

SeniorHybryda·KrakówFull-time·Umowa o pracę

#472562·Dodano 2 dni temu·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Azure DevOpsJira ServiceNowCVSSPatch managementPower BIMS ExcelQualysTenableRapid7

Podsumowanie oferty

Join the Patch Orchestration Team in Group Technology Services to coordinate remediation of vulnerabilities and weaknesses across major IT technologies. The role focuses on vulnerability reporting, remediation tracking, and security exposure dashboards using tools including Rapid7 InsightVM, Excel, and Power BI.

Wymagania

Experience with vulnerability scanner tools such as Rapid7, Tenable, Qualys, or similar platforms.
Strong proficiency in Excel, including pivot tables, formulas, and macros, and in Power BI.
Solid understanding of vulnerability types, CVSS, threat exposure, and patch management.
Ability to track, escalate, and follow up on remediation tasks with multiple teams.
Ability to explain technical security issues to non-technical stakeholders.
Familiarity with risk-based prioritisation and remediation strategies.
Strong interpersonal skills to manage productive relationships with cross-functional stakeholders.
Ability to coordinate stakeholders and drive outcomes autonomously.
Experience with ITSM tools such as ServiceNow, Jira, or Azure DevOps for remediation workflows and ticketing.
Excellent verbal and written communication skills.
Strong collaboration skills with technical and non-technical stakeholders.
Ability to work in a fast-paced environment with multiple priorities and deadlines.
Strong operational discipline and ability to manage large volumes of findings.
Comfortable working with ambiguity and driving clarity across teams.
Persistent, structured, and outcome-oriented in follow-up and escalation.
Ability to convert complex technical data into clear operational actions.

Nice to have:

Experience with automated orchestration platforms, such as SOAR solutions.
Certifications such as CompTIA Security+, ISC2 CC, or CEH.
Exposure to governance and compliance frameworks such as ISO 27001, NIST, and PCI-DSS.
Experience writing and presenting reports for senior leadership.

Obowiązki

Vulnerability Scanning & Data Collection:

Support stakeholders in using tools such as Rapid7 InsightVM.
Monitor weekly reports to ensure successful execution and data integrity.
Validate and verify scan findings, reduce exceptions, remove duplicate findings, and improve data quality.

Reporting & Dashboard Updates:

Generate and update vulnerability reports for relevant teams.
Maintain and enhance dashboards in Excel and Power BI to reflect current security exposure.
Update remediation KPIs, trends, and compliance scores.
Monitor remediation SLAs and drive adherence across teams.
Track overdue vulnerabilities, mean time to remediate, reopened findings, exception volumes, and recurring vulnerabilities.
Identify systemic causes of delayed remediation and propose process improvements.
Provide actionable insights to reduce the vulnerability backlog and improve patch compliance.

Remediation Coordination:

Review open vulnerabilities and track remediation progress with relevant asset or application owners.
Send daily or weekly follow-up emails and reminders to responsible parties.
Help stakeholders understand processes, vulnerability severity, business impact, and recommended remediation actions.
Route vulnerabilities to the correct asset owners and track them through agreed workflows.
Monitor ageing, SLA breaches, exceptions, and blockers, and drive timely resolution.
Prioritise remediation based on severity, exploitability, asset criticality, exposure, and business impact.
Distinguish between false positives, accepted risks, compensating controls, and genuine remediation needs.

Advisory & Support:

Respond to queries from IT teams and business units regarding vulnerabilities and remediation orchestration.
Support IT teams and business units with vulnerability trend analysis and related insights.
Support patching cycles by correlating vulnerabilities to available patches or configuration fixes.

Documentation & Process Management:

Document remediation orchestration and related processes.
Track vulnerabilities through their lifecycle stages: identified, validated, assigned, remediated, exceptioned, risk accepted, and closed.
Capture and maintain evidence of remediation or exception approval.
Maintain clear audit trails for vulnerability decisions and remediation status.
Create team- and tribe-level dashboards for personalised reporting and security posture management.
Translate vulnerability findings into actionable tickets, tasks, or remediation campaigns.

Stakeholder Engagement:

Participate in daily, weekly, and monthly security orchestration and governance calls with business units, senior management, and stakeholders.
Liaise with infrastructure, development, and risk teams to align on remediation priorities.
Escalate unresolved or critical issues to relevant senior management stakeholders, including CISO and GTS, periodically and as needed.
Support governance routines, including weekly review boards, escalation forums, and monthly risk reporting.
Coordinate exception, deferral, and risk acceptance requests.
Ensure exceptions are time-bound, justified, approved, and periodically reviewed.
Track compensating controls and residual risk when immediate remediation is not possible.
Escalate expired or repeatedly extended exceptions.

Executive Reporting & Communication:

Draft bullet points or slides for management reports and board updates as needed.
Prepare quarterly metrics and summaries on the organisation’s security posture.
Produce and share executive dashboards highlighting risk reduction progress and key wins.

Benefity

Join a learning and development environment with an emphasis on knowledge sharing and training.

Euroclear

19 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz