{"id":1187344,"url":"https://alion.io/job/asos-vulnerability-threat-exposure-management-analyst","title":"Vulnerability, Threat & Exposure Management Analyst","company":{"id":39790,"name":"ASOS","domain":"asos.com","url":"https://alion.io/company/asos","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":80,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":15,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":74000,"max_usd":170000,"period":"year","method":"role_country_seniority_unknown","sample_n":79},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Kubernetes","optional":false},{"name":"Nessus","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"Wiz","optional":false},{"name":"Microsoft Defender","optional":true}],"status":"closed","first_seen_at":"2026-09-24T09:35:57Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-09-28T13:48:18Z","board_verified":false,"closed_at":"2026-09-28T13:48:18Z","days_open":4,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":4},"description":"We're ASOS, the online retailer for fashion lovers all around the world.\nWe exist to give our customers the confidence to be whoever they want to be, and that goes for our people too. At ASOS, you're free to be your true self without judgement, and channel your creativity into a platform used by millions.\nEveryone needs some help showing up as their best self. We're Disability Confident Committed - let our Talent team know if you need any reasonable adjustments throughout the recruitment process.\n The Vulnerability, Threat & Exposure Management analyst helps ASOS understand and reduce the technology exposures most likely to contribute to material cyber risk.\nRather than treating vulnerabilities in isolation, the role considers vulnerabilities, misconfigurations, identity and privilege weaknesses, cloud security risks, exposed assets and attack paths in the context of threat intelligence, exploitability and business criticality.\nYou’ll turn technical security data into clear, risk-based priorities, helping engineering and technology teams focus remediation effort where it delivers the greatest reduction in exposure and cyber risk.\nThis is an analytical and collaborative role. You’ll work across ASOS’s technology estate to understand what is exposed, how it could realistically be exploited, what an attacker could reach, what matters most to ASOS, and what we should do about it.\nRole details\nIdentify and assess technology exposures across ASOS, including vulnerabilities, misconfigurations, identity and privilege weaknesses, exposed assets and services, cloud security risks and attack paths.\nPerform risk-based analysis and prioritisation, considering exploitability, threat intelligence, attacker behaviour, asset criticality, business context, accessibility and compensating controls to determine which exposures matter most.\nAnalyse attack paths to understand how vulnerabilities, configurations, identities, privileges and trust relationships could combine to enable compromise of critical ASOS systems, services or data.\nApply threat intelligence and exploitation data to understand which threats and exposures are most relevant to ASOS and where action should be prioritised.\nAssess exposure across modern technology environments, including cloud platforms, applications, APIs, virtual machines, containers, endpoints, identities, networks and supporting infrastructure.\nSupport continuous attack-surface discovery, helping identify unknown, unmanaged, incorrectly classified or unexpectedly exposed assets and services.\nPartner with engineering, product, platform and infrastructure teams to agree proportionate remediation or mitigation strategies, focusing effort on actions that deliver the greatest reduction in cyber risk.\nTrack significant exposures through to resolution, escalating material or persistent risk where appropriate and helping teams identify effective remediation or compensating controls.\nIdentify recurring exposure patterns and systemic control weaknesses, working with technology teams to address root causes and eliminate classes of exposure rather than repeatedly treating individual findings.\nAssess the effectiveness of preventative and compensating controls in reducing identified exposures and attack paths, recommending improvements where required.\nValidate significant exposures and remediation outcomes, using appropriate technical evidence to confirm that identified risk has been materially reduced.\nTranslate technical findings into clear risk insights, communicating exposure, potential business impact and remediation priorities to both technical and non-technical stakeholders.\nContribute to meaningful exposure metrics and reporting that demonstrate changes in organisational risk and remediation effectiveness rather than relying solely on vulnerability volumes or severity scores.\nContribute to the continuous improvement of ASOS’s Threat & Exposure Management capability, including automation, data enrichment, prioritisation models, metrics, reporting, workflow integration, processes and governance.\nPromote secure-by-design and proportionate, risk-based security practices across ASOS technology teams.\n About You:\nRelevant experience as a Vulnerability Analyst, SOC Analyst, or in a similar role.\nUnderstanding of common vulnerability types and attack techniques.\nExperience with vulnerability management, cloud security or security assessment tooling (e.g. Wiz, Defender, Nessus, Qualys or similar).\nUnderstanding of enterprise technologies, including cloud platforms, infrastructure, networking and software development practices.\nAbility to leverage threat intelligence to assess vulnerability risk and inform remediation priorities.\nKnowledge of container and Kubernetes security is desirable.\nUnderstanding of cyber security risk management principles and risk-based decision making.\nExcellent written and verbal communication skills for presenting technical information clearly to non-technical audiences.\nNaturally inquisitive, with the ability to investigate security risks across diverse technologies and identify potential threats to the organisation.\nSelf-motivated with strong problem-solving and critical thinking skills.\n You don’t need to have worked in a role called Threat & Exposure Management before. We’re looking for someone who can combine technical security knowledge with curiosity, analytical thinking and an understanding of risk.\nYou’ll ideally have:\nRelevant experience in exposure management, vulnerability management, cloud security, security engineering, threat intelligence, SOC/security operations, or another role involving the analysis of technology and cyber risk.\nA strong understanding of common vulnerabilities, security misconfigurations and attacker techniques across modern technology environments.\nExperience using vulnerability, exposure, cloud security or security assessment tooling such as Wiz, Microsoft Defender, Nessus, Qualys or equivalent platforms.\nAn understanding of cloud platforms and cloud-native technologies, including virtual machines, containers and modern application architectures.\nAn understanding of identity and privilege as part of the attack surface, and how identity weaknesses can contribute to attack paths.\nAn understanding of attack paths and attacker behaviour, including how multiple weaknesses can be combined to reach critical assets or services.\nAn understanding of cyber security risk management and the ability to make risk-based rather than severity-based decisions.\nKnowledge of container and Kubernetes security is desirable.\nStrong analytical and critical-thinking skills, with a naturally inquisitive approach to investigating security issues across diverse technologies.\nStrong written and verbal communication skills, with the ability to explain complex technical issues clearly and turn them into actionable priorities for different audiences.\nA collaborative approach and the ability to work effectively with engineering and technology teams to achieve practical security outcomes.\nWhat success looks like\nSuccess in this role isn’t measured by how many vulnerabilities you find or tickets you create. It’s measured by how effectively we understand and reduce the exposures that matter most to ASOS.\nYou’ll help us move from vulnerability management based primarily on individual findings and severity scores towards a more continuous, threat-informed and risk-based approach to understanding and reducing our attack surface.\nBeneFITS’\nEmployee discount (hello ASOS discount!) \nEmployee sample sales \n25 days paid annual leave + an extra celebration day for a special moment \nDiscretionary bonus scheme \nPrivate medical care scheme \nFlexible benefits allowance - which you can choose to take as extra cash, or use towards other benefits \nOpportunity for personalised learning and in-the-moment experiences that enable you to thrive and excel in your role","description_format":"text","description_chars":7922,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Annual leave"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Commerce"],"lifecycle":[{"event":"open","at":"2026-09-24T15:08:23Z"},{"event":"close","at":"2026-09-28T13:48:18Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker, Senior or Specialist Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker; Global Business Mobility: Senior or Specialist Worker","cap_exempt":false,"checked_at":"2026-10-21T06:25:45+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":null,"pay":null,"html_url":"https://alion.io/job/asos-vulnerability-threat-exposure-management-analyst","json_url":"https://alion.io/job/asos-vulnerability-threat-exposure-management-analyst.json","meta":{"generated_at":"2026-10-21T13:15:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18817,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":39790},"rest":"https://alion.io/mcp/rest/get_company?id=39790"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fasos-vulnerability-threat-exposure-management-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fasos-vulnerability-threat-exposure-management-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fasos-vulnerability-threat-exposure-management-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/asos-vulnerability-threat-exposure-management-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fasos-vulnerability-threat-exposure-management-analyst"}]}