Manager - Security Engineer Vulnerability and External Attack Surface Management

Responsibilities

The Security Engineer – Vulnerability & EASM (External Attack Surface Management) will be responsible for the following:

Vulnerability Management (core)

• Manage the vulnerability management lifecycle – discovery, validation, prioritization, remediation tracking and verification – across infrastructure, cloud, applications and telecom/OT assets.
• Operate and tune enterprise vulnerability scanning platforms (e.g., Tenable, Qualys), ensuring complete and accurate asset coverage.
• Define and enforce risk-based remediation SLAs; partner with infrastructure, application and platform teams to drive closure.
• Maintain authoritative vulnerability and asset inventories, reducing false positives through validation and contextual enrichment.

External Attack Surface Management (EASM)

• Continuously discover, map and monitor MTN’s internet-facing assets – including shadow IT, exposed services, certificates, domains and cloud footprints.
• Operate EASM tooling (e.g., Microsoft Defender EASM, Shodan) to surface exposure before adversaries do.
• Correlate external exposure with internal vulnerability and threat data to produce a unified, prioritized view of organizational risk.
• Drive rapid remediation of high-risk external exposures and unauthorized or unmanaged assets.

Practical Risk & Remediation

• Translate technical findings into business risk – prioritizing by exploitability (CVSS, EPSS, CISA KEV), asset criticality and threat context, not raw vulnerability counts.
• Recommend pragmatic, achievable remediation and compensating controls; avoid unmanageable “boil-the-ocean” backlogs.
• Lead targeted remediation campaigns and track measurable reductions in exploitable risk over time.

Threat Analysis & Forward-Looking Defence

• Integrate threat intelligence to contextualize vulnerabilities against active exploitation and threat-actor behavior.
• Anticipate emerging exposure – new CVEs, attack techniques, supply-chain and cloud risks – and proactively assess MTN’s susceptibility.
• Contribute to detection, hardening and resilience improvements informed by attacker tradecraft (MITRE ATT&CK).

AI-Driven Innovation & Thought Leadership

• Pioneer the use of agentic AI and large-language-model platforms (e.g., Anthropic Claude / Claude Code or equivalent) to automate vulnerability triage, enrichment, remediation guidance and reporting.
• Design and prototype AI-assisted workflows that scale VM and EASM operations across MTN’s Group markets.
• Stay ahead of developments in AI, offensive tooling and exposure management, bringing best practice into the team

Qualifications

Qualifications:

• Bachelor’s degree in Computer Science, Information Security, Engineering or a related field – or equivalent practical experience.
• 6+ years in information security, with at least 3–4 years dedicated to vulnerability management and/or attack surface management.
• Demonstrable experience operating enterprise VM and EASM tooling at scale.
• Hands-on scripting/automation (Python, PowerShell) and data analysis capability.
• Proven track record of driving measurable risk-reduction and remediation outcomes.
• Exposure to AI / agentic-AI tooling applied to security operations – strongly preferred

Preferred Certifications:

• OSCP, GIAC (e.g., GWAPT, GEVA, GCTI), CISSP, CEH or equivalent.
• Cloud security certifications (e.g., AZ-500, AWS Security Specialty, CCSP).

Technical Skills & Tools:

• Vulnerability management: Tenable / Qualys or equivalent.
• Attack surface management: Microsoft Defender EASM / Shodan or equivalent.
• Prioritization frameworks: CVSS, EPSS, CISA KEV.
• Threat frameworks: MITRE ATT&CK; threat-intelligence integration.
• Cloud security: Azure / AWS / GCP exposure management.
• Data & automation: Python, SQL, Power BI, SOAR / workflow automation.
• AI: agentic-AI / LLM platforms (Anthropic Claude / Claude Code or equivalent); prompt and workflow design.

Behavioural Competencies:

• Forward-thinking and curious – anticipates rather than reacts.
• Strong communicator who translates technical risk for non-technical audiences.
• Pragmatic problem-solver focused on real-world, achievable remediation.
• Collaborative, with the credibility to influence across teams and markets.
• Self-driven thought leader who raises the capability of those around them.

Apply Before 11/02/2026