{"id":2772466,"url":"https://alion.io/job/ust-architect-i-information-security","title":"Architect I - Information Security","company":{"id":1774626,"name":"UST","domain":"ust.com","url":"https://alion.io/company/ust-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"RippleHire","truth_index":{"grade":"B","score":75,"open_postings":137,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":23,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Thiruvananthapuram, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":15500,"max_usd":38000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":672},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon S3","optional":false},{"name":"CI/CD","optional":false},{"name":"Cloudflare","optional":false},{"name":"Crowdstrike","optional":false},{"name":"CVE","optional":false},{"name":"CVSS","optional":false},{"name":"CyberArk","optional":false},{"name":"IAM","optional":false},{"name":"KEV","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Nessus","optional":false},{"name":"OpenVAS","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Acunetix","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Bash","optional":true},{"name":"Fortify","optional":true},{"name":"GCP","optional":true},{"name":"ISO 27001","optional":true},{"name":"Lacework","optional":true},{"name":"Linux","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"PCI DSS","optional":true},{"name":"Power BI","optional":true},{"name":"PowerShell","optional":true},{"name":"Prisma Cloud","optional":true},{"name":"Python","optional":true},{"name":"Recorded Future","optional":true},{"name":"Shodan","optional":true},{"name":"SOC 2","optional":true},{"name":"Splunk","optional":true},{"name":"Wiz","optional":true}],"status":"live","first_seen_at":"2026-09-10T00:00:00Z","employer_posted_date":"2026-10-17","last_verified_at":"2026-10-21T16:20:50Z","board_verified":true,"closed_at":null,"days_open":41,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":41},"description":"Job Description: Vulnerability Management & Cyber Threat Intelligence Engineer Position Overview We seek an experienced Vulnerability Management & Cyber Threat Intelligence (CTI) Engineer to lead vulnerability identification, risk assessment, remediation tracking, and threat intelligence integration. This role owns the vulnerability lifecycle, ensures timely remediation, and integrates threat intelligence to protect critical assets. Key Responsibilities Vulnerability Identification, Aggregation & Normalization\nIngest and normalize vulnerability data from CrowdStrike Spotlight and related scanners (endpoint, network, cloud, web app) into standardized formats (CVE IDs, severity, discovery dates)\nDeduplicate entries, cross-reference against asset inventory for owner/business unit assignment, and filter false positives\nTrack newly published CVEs and zero-days relevant to the technology stack Risk-Based Prioritization & Triage\nAssess vulnerabilities via risk models, threat actor targeting, and organizational standards; assign risk tiers (Critical/High/Medium/Low) driving SLA and escalation\nEscalate urgent cases (zero-day exploitation, sensitive systems); document prioritization rationale and re-prioritize as new intel, PoCs, or patches emerge Vulnerability Register Management & Lifecycle Tracking\nOwn and update the master vulnerability register (ServiceNow or equivalent); monitor aging and SLA compliance, flagging breaches to owners/management\nCoordinate and verify remediation/compensating controls; document escalations (incompatibility, vendor delays) and confirm closure only after verified mitigation Remediation Assignment & Stakeholder Engagement\nCreate actionable ServiceNow tickets; communicate priorities and escalate high-risk/non-compliant items to owners and Cyber Security leadership\nRecommend remediation approaches (patch windows, testing, mitigations); collaborate on constraints and maintain audit trails of decisions Compensating Controls & Exception Management\nAssess and document compensating controls when patches aren't feasible, with implementation guidance and residual risk assessment\nSupport formal exception processes and track control effectiveness/implementation gaps Cloud Security Posture Management (CSPM)\nScan cloud environments via CSPM tools; categorize misconfigurations (open S3 buckets, permissive IAM, unencrypted DBs) and route to owners/DevOps via ServiceNow\nSupport CI/CD security scanning to prevent drift; identify systemic posture patterns across regions/teams Vulnerability Reporting & Governance\nReport month-on-month vulnerability volumes, High/Critical trends, and average time-to-remediation by severity/owner\nIdentify systemic/recurrent issues with root cause analysis; provide industry/peer benchmarking where available Cyber Threat Intelligence Integration\nAnalyze CTI feeds (CISA KEV, vendor advisories) to accelerate remediation for actively exploited vulnerabilities; cross-reference threat actor capabilities for exploitation likelihood\nProvide early warning on emerging/zero-day threats; support IR investigations; brief leadership and re-prioritize based on new intelligence Threat Intelligence Consumption and Analysis\nMonitor CrowdStrike CAO Premium intelligence; identify threat actors, campaigns, and malware relevant to sector, geography, and technology estate (M365, Entra ID, CrowdStrike, Cloudflare, CyberArk, cloud, critical apps)\nProduce actionable assessments for Security Operations and technical stakeholders Threat Actor Tracking\nMaintain financial-sector threat actor profiles; track TTPs and map to MITRE ATT&CK\nIdentify adversary behavior changes/risk; provide periodic threat landscape updates to leadership Priority Intelligence Requirements (PIRs)\nDevelop and maintain Priority Intelligence Requirements aligned to business risk, covering: financially motivated threats, BEC, identity-based attacks, insider threats, supply-chain/third-party concentration risks, and cloud threats\nContinuously assess whether intelligence requirements are being met Intelligence Driven Detection Engineering\nConvert CrowdStrike CAO intelligence into detection use cases; work with SIEM/SOAR Engineer to tune detections to adversary tradecraft\nRecommend monitoring use cases from threat actor TTPs; validate coverage against relevant MITRE ATT&CK techniques IOC Management\nCollect, validate, enrich, and manage IOCs; distribute across CrowdStrike, SIEM, SOAR, email security, and other platforms\nMaintain IOC lifecycle (ingestion, validation, expiration, retirement) and measure operational effectiveness Threat Hunting Support\nProduce threat hunting hypotheses from intelligence reporting; develop hunting packages (TTPs, indicators, detection logic, methodology)\nSupport investigations resulting from hunting activities Required Qualifications\n10+ years of experience in vulnerability management, security operations, or related cybersecurity disciplines\nDemonstrated expertise with vulnerability management platforms (ServiceNow, Qualys, Tenable Nessus, Rapid7, or equivalent)\nStrong understanding of CVSS scoring, CVE databases, and vulnerability classification frameworks\nProficiency with SIEM platforms and log aggregation systems\nExperience with threat intelligence platforms and CTI feed integration\nKnowledge of common vulnerability scanning tools (CrowdStrike Spotlight, Nessus, OpenVAS, Qualys, etc.)\nStrong written and verbal communication skills with ability to explain technical concepts to non-technical stakeholders\nExcellent project management and organizational skills with ability to manage multiple priorities\nExperience creating metrics-driven vulnerability reports and dashboards Preferred Qualifications\nRelevant certifications (CEH, CISSP, GIAC GEVA, GIAC GCIH, or equivalent)\nExperience with Cloud Security Posture Management (CSPM) tools such as Prisma Cloud, Wiz, or Lacework\nFamiliarity with DevSecOps practices and CI/CD pipeline security integration\nKnowledge of compliance frameworks (PCI-DSS, SOC 2, ISO 27001, NIST, etc.)\nExperience with incident response and breach investigation\nBackground in threat actor profiling and threat campaign analysis\nProficiency in scripting or programming (Python, PowerShell, Bash) for automation and data processing\nExperience with multiple cloud platforms (AWS, Azure, GCP) Technical Skills & Tools\nVulnerability Management Platforms: ServiceNow, Qualys, Tenable, Rapid7, Fortify\nSecurity & Threat Intelligence: CISA KEV, Shodan, Mitre ATT&CK, Recorded Future, Flashpoint\nCloud Security Tools: CrowdStrike Spotlight, Wiz, Prisma Cloud, Lacework, Qualys CSPM\nSIEM Platforms: Splunk, ELK Stack, Microsoft Sentinel\nScanning Tools: Nessus, OpenVAS, Acunetix, Fortify SCA\nData Analysis: Excel, Power BI, Splunk dashboards, data visualization tools\nScripting/Automation: Python, PowerShell, Bash (preferred but not required)\nOperating Systems: Windows, Linux, cloud-native environments","description_format":"text","description_chars":6927,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation","IT Outsourcing & Dedicated Teams"],"lifecycle":[{"event":"open","at":"2026-10-17T06:49:13Z"}],"visa":[],"liveness":{"score":17,"band":"cold","label":"Long shot","p_open":1,"p_active":0.468,"p_room":0.36,"age_days":41,"expected_fill_days":23,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/ust-architect-i-information-security","json_url":"https://alion.io/job/ust-architect-i-information-security.json","meta":{"generated_at":"2026-10-21T18:15:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25709,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1774626},"rest":"https://alion.io/mcp/rest/get_company?id=1774626"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fust-architect-i-information-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fust-architect-i-information-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fust-architect-i-information-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ust-architect-i-information-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fust-architect-i-information-security"}]}