Vulnerability Management Engineer

We are looking for an experienced Vulnerability Management Engineer with 7-8 years of experience in vulnerability assessment, exposure management, risk analysis, remediation tracking, and security operations. The ideal candidate will have handson experience with vulnerability management platforms such as Tenable, Qualys, Rapid7 InsightVM, or Microsoft Defender Vulnerability Management, along with strong analytical, reporting, and automation skills.

The candidate will be responsible for managing endtoend vulnerability management operations, identifying and prioritizing security risks, monitoring remediation progress, ensuring SLA compliance, and collaborating with infrastructure, application, cloud, and cybersecurity teams to reduce the organization's overall security exposure. The role also requires proficiency in scripting and data analysis to automate operational workflows, improve reporting accuracy, and enhance the efficiency of vulnerability management processes.

Key Roles and Responsibilities :

- Manage daytoday vulnerability and exposure management operations, including vulnerability identification, assessment, tracking, prioritization, and remediation.

- Monitor vulnerability scan results and security findings across endpoints, servers, applications, network devices, and cloud environments.

- Analyze vulnerability findings to determine their severity, business impact, exploitability, and associated security risks.

- Prioritize remediation activities based on CVSS scores, asset criticality, known exploited vulnerabilities, threat intelligence, and business context.

- Identify recurring vulnerabilities, emerging threats, and gaps in existing vulnerability management processes.

- Support continuous improvement of vulnerability management coverage, asset visibility, and risk reduction initiatives.

- Coordinate with infrastructure, application, cloud, network, and security teams to drive timely remediation of identified vulnerabilities.

- Track remediation progress and ensure vulnerabilities are addressed within defined servicelevel agreements (SLAs).

- Maintain remediation trackers and follow up with stakeholders on overdue, critical, and highrisk vulnerabilities.

- Validate remediation activities through rescans, technical evidence, or other approved verification methods.

- Identify remediation blockers and escalate unresolved or overdue vulnerabilities to the relevant stakeholders.

- Support risk acceptance, exception management, and compensating control documentation in accordance with organizational security policies.

- Analyze vulnerability datasets and security findings to identify risk patterns, recurring issues, and remediation bottlenecks.

- Correlate vulnerability information with asset inventories, ownership data, business criticality, and threat intelligence where available.

- Identify highrisk assets and vulnerabilities requiring immediate remediation or additional security controls.

- Perform trend analysis to measure vulnerability backlog, aging, remediation effectiveness, and overall exposure reduction.

- Conduct data validation, reconciliation, and quality checks to ensure accurate, complete, and consistent vulnerability reporting.

- Provide actionable insights and recommendations to improve security posture and remediation outcomes.

- Develop and maintain vulnerability management dashboards, operational reports, and management presentations.

- Track key performance indicators (KPIs) and key risk indicators (KRIs) related to vulnerability remediation and exposure management.

- Prepare periodic reports on critical and highseverity vulnerabilities, overdue remediation items, SLA compliance, and vulnerability aging.

- Monitor vulnerability backlog trends and provide visibility into remediation performance across teams and business units.

- Ensure reporting accuracy through regular data quality checks and reconciliation.

- Present findings, trends, risks, and remediation progress to technical teams, security leadership, and other stakeholders.

- Develop and maintain scripts using Python, PowerShell, SQL, or similar technologies to automate vulnerability reporting and data processing.

- Automate data extraction, transformation, validation, reconciliation, and consolidation from multiple security tools and data sources.

- Streamline recurring operational activities to reduce manual effort, improve accuracy, and increase reporting efficiency.

- Build automated workflows for remediation tracking, SLA monitoring, exception identification, and stakeholder reporting.

- Identify opportunities to integrate vulnerability management platforms with ticketing systems, asset inventories, and reporting tools.

- Maintain documentation and perform testing to ensure automation scripts and workflows remain reliable and maintainable.

- Operate and analyze vulnerability management platforms such as :

i. Tenable / Tenable Nessus

ii. Qualys Vulnerability Management

iii. Rapid7 InsightVM

iv. Microsoft Defender Vulnerability Management

- Review scan results, vulnerability findings, asset information, severity ratings, and remediation recommendations.

- Support vulnerability scan coverage monitoring, asset reconciliation, and investigation of inconsistent or duplicate findings.

- Generate reports and extract relevant data from vulnerability management tools for further analysis.

- Work with tool administrators and security engineering teams to address reporting, integration, and data quality issues.

- Stay updated on new platform capabilities, vulnerability detection methods, and exposure management practices.

- Collaborate with cybersecurity, IT infrastructure, application development, cloud operations, and business teams to resolve security findings.

- Engage asset owners and technical teams to establish remediation timelines, clarify ownership, and drive accountability.

- Maintain operational procedures, standard operating procedures (SOPs), remediation guidelines, and process documentation.

- Identify process gaps and recommend improvements to enhance operational efficiency and vulnerability closure rates.

- Support vulnerability management governance, audit requests, compliance reviews, and evidence collection.

- Contribute to continuous improvement initiatives related to vulnerability management maturity and risk reduction.

Required Skills and Qualifications :

- 7- 8 years of relevant experience in vulnerability management, cybersecurity operations, security risk analysis, or a related domain.

- Strong handson experience in vulnerability identification, assessment, prioritization, remediation tracking, and validation.

- Practical experience with at least one vulnerability management platform, such as Tenable, Qualys, Rapid7 InsightVM, or Microsoft Defender Vulnerability Management.

- Proficiency in Python, PowerShell, SQL, or similar scripting languages for data processing and automation.

- Strong data analysis skills, including data validation, reconciliation, trend analysis, and reporting.

- Experience creating dashboards, operational reports, and managementlevel security metrics.

- Good understanding of CVSS scoring, vulnerability severity classification, remediation SLAs, and riskbased prioritization.

- Experience coordinating with crossfunctional technical teams to drive vulnerability remediation

Skills

Vulnerability Assessment, Vulnerability Management, Qualys, Rapid 7, Microsoft Defender, Security Risk Management, Cyber Security