Job Summary

The Vulnerability Analyst is expected to perform the following activities:

• Perform vulnerability assessment and security configuration assessment activities across servers, network devices, databases, security devices, operating systems, and other infrastructure components.
• Execute scheduled and ad-hoc scans using VA/SCA tools and ensure scan coverage, scan health, authentication status, and scan quality.
• Analyze vulnerability assessment results to identify true positives, false positives, exceptions, and remediation requirements.
• Coordinate with GIT, GIS, application, infrastructure, and other internal teams for remediation tracking and closure of identified vulnerabilities gaps.
• Prepare and publish vulnerability, remediation, SLA, and exception reports for internal governance and management review.
• Track remediation progress and follow up with respective teams to ensure timely closure as per defined SLA.
• Support validation of remediated vulnerabilities through rescans or evidence review.
• Maintain accurate records of findings, exceptions, risk acceptance, false positives, and remediation evidence.
• Support internal and external audit requirements by providing required vulnerability management and compliance artifacts.
• Monitor threat advisories, critical vulnerabilities, and threat intelligence updates relevant to the organization’s technology environment.
• Escalate risks, delays, scan failures, authentication issues, or remediation challenges to senior team members or management as required.
• Contribute to continuous improvement of the Vulnerability Management and Security Configuration Management program from a process and technology standpoint.
• Maintain professional communication with stakeholders and support a solution-focused approach in issue resolution.

Key Responsibilities

The Vulnerability Analyst is expected to perform the following activities:

• Perform vulnerability assessment and security configuration assessment activities across servers, network devices, databases, security devices, operating systems, and other infrastructure components.
• Execute scheduled and ad-hoc scans using VA/SCA tools and ensure scan coverage, scan health, authentication status, and scan quality.
• Analyze vulnerability assessment results to identify true positives, false positives, exceptions, and remediation requirements.
• Coordinate with GIT, GIS, application, infrastructure, and other internal teams for remediation tracking and closure of identified vulnerabilities gaps.
• Prepare and publish vulnerability, remediation, SLA, and exception reports for internal governance and management review.
• Track remediation progress and follow up with respective teams to ensure timely closure as per defined SLA.
• Support validation of remediated vulnerabilities through rescans or evidence review.
• Maintain accurate records of findings, exceptions, risk acceptance, false positives, and remediation evidence.
• Support internal and external audit requirements by providing required vulnerability management and compliance artifacts.
• Monitor threat advisories, critical vulnerabilities, and threat intelligence updates relevant to the organization’s technology environment.
• Escalate risks, delays, scan failures, authentication issues, or remediation challenges to senior team members or management as required.
• Contribute to continuous improvement of the Vulnerability Management and Security Configuration Management program from a process and technology standpoint.
• Maintain professional communication with stakeholders and support a solution-focused approach in issue resolution.

Skill Requirements

• 3 to 6 years of relevant experience in Information Security, Vulnerability Management, IT Security Operations, or Infrastructure Security.
• Hands-on experience with Vulnerability Assessment tools such as Qualys, Tenable, Rapid7 Nexpose.
• Experience in analyzing vulnerability scan results, compliance scan results, remediation evidence, and exception requests.
• Good understanding of vulnerability lifecycle management, including identification, prioritization, assignment, remediation tracking, validation, and closure.
• Knowledge of infrastructure technologies including Windows, Linux, network devices, databases, virtualization, storage, and security devices.
• Awareness of cybersecurity frameworks and benchmarks such as CIS Benchmarks, NIST, OWASP, and OSSTMM.
• Working knowledge of standards and regulatory requirements such as ISO 27001, PCI DSS, SOC 1/2, and HIPAA.
• Good understanding of CVEs, CVSS, threat advisories, vendor patches, exploitability, and risk-based vulnerability prioritization.
• Experience in preparing reports, dashboards, trackers, and management updates related to vulnerabilities and compliance findings.
• Strong written and verbal communication skills with the ability to coordinate with technical and non-technical stakeholders.

Educational Qualification

• Bachelor’s degree in Computer Science, Computer Engineering, Information Technology, Cybersecurity, or a related discipline.

Other Requirements