{"id":94471,"url":"https://alion.io/job/qualys-senior-vulnerability-analyst","title":"Senior Vulnerability Analyst","company":{"id":18966,"name":"Qualys","domain":"qualys.com","url":"https://alion.io/company/qualys","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pune, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":18000,"max_usd":39000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"C++","optional":false},{"name":"CVE","optional":false},{"name":"CVSS","optional":false},{"name":"CWE","optional":false},{"name":"Java","optional":false},{"name":"Linux","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"SBOM","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"Python","optional":true},{"name":"Red Teaming","optional":true},{"name":"Snyk","optional":true},{"name":"Trivy","optional":true}],"status":"live","first_seen_at":"2026-06-30T00:00:00Z","employer_posted_date":"2026-06-30","last_verified_at":"2026-10-17T08:12:06Z","board_verified":true,"closed_at":null,"days_open":109,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":109},"description":"Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!\nAbout the Role\nQualys is seeking aSeniorVulnerabilityAnalystto join the Product Security Incident Response Team (PSIRT) as a hands-on technical practitioner. Reporting to the LeadVulnerabilityAnalyst, you will execute the day-to-day work ofvulnerabilitydiscovery, triage, analysis, and remediation tracking across a product portfolio of more than 35 products. Where the Lead owns program-level strategy, cross-functional accountability, and executive communications, this role is responsible for the depth and rigor of the technical analysis that underpins every PSIRT decision.\nThis is an individual contributor role for a mid-career security professional who thrives in the details: reviewing source code to assess exploitability, writing precise advisories, building detection logic, and driving engineering teams toward timely remediation. You will work across the fullvulnerabilitylifecycle, from initial intake through coordinated disclosure, and contribute directly to the tools, automation, and processes that make the PSIRT function scale.\nKey Responsibilities\nVulnerability Analysis & Triage\nPerform deep technical analysis of reported vulnerabilities, including root-cause investigation, exploitability assessment, CVSS and SSVC scoring, and impact determination across affected products.\nTriage incomingvulnerabilityreports from internal scanners, SCA tooling, external researchers, and coordinated disclosure channels, ensuring accurate classification and priority assignment.\nAnalyze source code in C/C++, Java, and web application frameworks to validatevulnerabilityfindings and assess the effectiveness of proposed fixes.\nSupport major incident response efforts led by the LeadVulnerabilityAnalyst, providing technical depth during war-room triage of high-severity and zero-day vulnerabilities.\nDetection, Monitoring & Threat Hunting\nBuild and maintain alerting rules and detection automation to identify known and emerging vulnerabilities in production products and services.\nContinuously hunt for CVEs and CWEs affecting Qualys components, third-party dependencies, and container base images; document findings with reproducible analysis.\nMonitor publicvulnerabilitydatabases, threat intelligence feeds, and researcher disclosures to proactively identify exposure across the product portfolio.\nInvestigatevulnerabilitytrends and systemic weakness patterns; surface findings to the LeadVulnerabilityAnalystto inform program-level priorities.\nCoordinate with counterparts in Security Operations, including CERT\nRemediation Tracking & SLA Compliance\nTrack engineering remediation efforts against defined patching SLAs, maintaining accurate status records for every openvulnerabilityacross product teams.\nCoordinate the determination of Affected Status for vulnerabilities and their corresponding fix timelines, working directly with product engineering owners.\nReview security exception requests, documenting technical justifications, compensating controls, and residual risk for Lead review and approval.\nPrepare SLA conformance reports and delinquency summaries for leadership review.\nAdvisory Authoring & Coordinated Disclosure\nDraft customer-facing Product Security Advisories (PSAs), ensuring technical accuracy, completeness, and consistency with PSIRT editorial standards.\nCoordinate with security testing teams to validate compensating controls, verify fix effectiveness, and confirm exploitability status prior to advisory publication.\nSupport the CoordinatedVulnerabilityDisclosure (CVD) process by managing researcher communications, tracking disclosure timelines, and preparing disclosure packages under the direction of the Lead.\nToolchain & Process Improvement\nDevelop and enhance PSIRT tooling, including SCA and SAST integration workflows, SBOM analysis pipelines, container security, andvulnerabilitydata lake ingestion.\nMaintain and improve PSIRT runbooks, triage playbooks, and standard operating procedures based on lessons learned and evolving threat landscape.\nBuild and refine dashboards and reporting artifacts that surfacevulnerabilityposture, remediation velocity, and trend data for leadership and audit consumption.\nRequired Qualifications\n5+ years of experience invulnerabilityanalysis, product security, application security, or security engineering.\n2+ years of experience operating within a PSIRT, CERT, or comparablevulnerabilitycoordination function.\nStrong written and verbale communication skills and attention to detail in technical documentation.\nStrong technical skills invulnerabilityanalysis, including root-cause investigation, exploitability assessment, and CVSS/SSVC scoring.\nDemonstrated proficiency in operating system security (Linux), container security, and web application security.\nWorking knowledge of C/C++, Java, and SaaS platform architectures sufficient to perform code-levelvulnerabilityassessment.\nHands-on experience with CVE/CWE analysis workflows,vulnerabilitydatabases, and threat intelligence sources.\nExperience drafting security advisories or technicalvulnerabilitywrite-ups for external audiences.\nPreferred Qualifications\nExperience with offensive security techniques, penetration testing, or red team operations.\nFamiliarity withvulnerabilityhanding standards and best practices.\nHands-on experience with SCA tools (e.g., Black Duck, Snyk, Trivy), SAST platforms, and SBOM tooling (SPDX, CycloneDX).\nFamiliarity with NIST SSDF, CoordinatedVulnerabilityDisclosure frameworks, and product security lifecycle models.\nExperience building detection rules, alerting logic, or security automation in scripting languages such as Python or Go.\nExposure to data lake architectures, security telemetry pipelines, orvulnerabilityanalytics platforms.\nActive participation in the security community through CTFs, research publications, conference presentations, or open-source contributions.\nRelevant certifications such as OSCP, GPEN, GWAPT, CSSLP, or equivalent.\nHow This Role Relates to the Lead\nThe LeadVulnerabilityAnalystowns PSIRT program strategy, cross-functional escalation authority, executive reporting, and external disclosure relationships. TheSeniorVulnerabilityAnalystprovides the technical execution layer: performing the detailed analysis, writing the initial advisory drafts, building the detection and tracking infrastructure, and ensuring everyvulnerabilityhas a complete, auditable record from intake through closure. Together, the two roles form the analytical core of the PSIRT function.\nWhy Qualys\nJoin a PSIRT function that is purpose-built to operate at the intersection of engineering accountability and security excellence.\nWork with a product portfolio that protects critical infrastructure across enterprise and government environments worldwide.\nShape thevulnerabilitymanagement practices of a company whose core mission is security.\nCollaborate with a leadership team that values operational rigor, transparency, and continuous improvement.","description_format":"text","description_chars":7059,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Endpoint Security","Information Security"],"lifecycle":[{"event":"open","at":"2026-06-30T00:00:00Z"}],"visa":[],"liveness":{"score":22,"band":"cold","label":"Long shot","p_open":1,"p_active":0.608,"p_room":0.36,"age_days":109,"expected_fill_days":59,"reasons":["conf:31","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/qualys-senior-vulnerability-analyst","json_url":"https://alion.io/job/qualys-senior-vulnerability-analyst.json","meta":{"generated_at":"2026-10-17T19:37:31Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2991,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":18966},"rest":"https://alion.io/mcp/rest/get_company?id=18966"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fqualys-senior-vulnerability-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fqualys-senior-vulnerability-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fqualys-senior-vulnerability-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/qualys-senior-vulnerability-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fqualys-senior-vulnerability-analyst"}]}