Location (Primary) - Noida / Chennai (Secondary)
GCF Level - 2A(01 nos) & 2B(01 nos)
Role Description
:- This role aims to receive, analyse, assess, coordinate, and monitor the remediation of vulnerabilities affecting the Company’s information systems. The role covers the full vulnerability lifecycle from detection to validation of fixing close collaboration with technical teams, the CERT, and governance bodies.
Key Tools and Environments - must have
Must hands on experience with detection and monitoring tools (Microsoft Defender for Endpoint EDR/XDR, WIZ, NESSUS PRO, Dynatrace)
Experience information system management and mapping tools (CMDB, VISIT),
Good knowledge of software distribution tools (SCCM, Intune, Satellite, Ansible, etc.), and reporting and analysis tools (PowerBI)
Experience with ServiceNow (SNOW), specifically the SECOPS module; ServiceNow SECOPS certification is preferred.
Strong understanding of - On‑prem infrastructure, SaaS / IaaS / Cloud workloads, Application vulnerability context
Ability to enrich findings using CMDB / asset mapping tools
Working knowledge of - SCCM, Intune, Ansible, Satellite
Mandatory Soft Skills:
Stakeholder & Coordination Skills - Ability to work with all stakeholders, and escalation handling and follow‑up discipline
Documentation & Effective Communication - Clear communication (EN/FR preferred) with structured documentation mindset
Process & Continuous Improvement Mindset - Ability to maintain VM process documentation, Identify gaps and improvement areas and support internal training and knowledge base enrichment
Job Description:
Vulnerability Management (Common VM Core) -
Oversee the receipt, analysis, and tracking of vulnerabilities from various sources (CERT, scanning tools, division reports)
manage backlog processing, and create or update vulnerability tickets using multiple detection and asset management tools.
Asset Identification and Qualification -
Assess and identify impacted assets across various environments,
Qualify vulnerabilities by evaluating exposure, versions, severity, attack vectors, and client context,
Enhance asset information using CMDB, and promptly issue alerts for critical vulnerabilities.
Definition and Steering of Remediation Plans -
Develop, implement, and coordinate remediation plans by analyzing security advisories and scan reports,
Defining tailored action strategies (including patches, workarounds, and updates),
Prioritizing tasks, tracking requests in ServiceNow,
Sending criticality-based reminders, and supporting remediation teams.
Monitoring and Validation of Patch Application
Monitor and validate patch application by ensuring timely verification,
Gathering remediation evidence (especially for critical vulnerabilities),
Documenting exceptions, and confirming remediation effectiveness prior to ticket closure.
Management of Critical P0 / P1 Vulnerabilities:-
Rapidly identify and assess impacted components and teams for critical vulnerabilities (P0/P1),
Ensure targeted follow-up with dedicated reporting and regular meetings, draft essential documentation (minutes and summaries),
Manage urgent vulnerability alerts, and escalate unresolved issues as needed.
Management of Non-CERT Vulnerabilities (VM3):-
Monitor and assess non-CERT vulnerabilities,
Evaluate their criticality using external sources,
Recommend and implement remediation strategies, and escalate issues as required.
CTI & Incidentology Management:-
Oversee remediation tracking for CERT Threat Intelligence findings, including asset identification,
Investigation, remediation coordination, and ticket processing
Support weekly CYB coordination,
Enhance CTI quality, and maintain a comprehensive knowledge base.
COD Controls – Management and Follow-up:
Oversee the execution, monitoring, and remediation tracking of key security controls—including asset management,
Privileged account onboarding/offboarding,
Identity administration, endpoint detection and response,
Patch management with ongoing deployment of additional measures to mitigate cyber risk.
Reporting and Steering:
Develop and maintain consolidated dashboards,
Prepare monthly reports, conduct incident analysis, recommend service improvements,
Adapt reporting to meet client expectations for vulnerability management.
Governance and Continuous Improvement
Oversee VM process documentation, monitor performance,
Develop internal training materials, interface with the product team for requirements and tool evolution,
Support data exchanges, and drive continuous service improvement.
Total Experience Expected: 06-08 years
Bachelor's degree or Master's in Computer Science, Engineering, or related field.
Strongly Recommeded Certifications
Anyone - CompTIA Security+ / ISC² SSCP / ISO 27001 Foundation
Anyone - Tenable Nessus Certification / GIAC Vulnerability Assessment / CREST Practitioner Security Analyst (CPSA)Anyone
Anyone - Microsoft SC‑200 / SC‑300
Anyone - AWS Security Specialty / Azure Security Engineer Associate
Prefered - ServiceNow SECOPS certification
This roles requires to follow CET working hours/Client business hours
At our organization, we are committed to fighting against all forms of discrimination. We foster a work environment that is inclusive and respectful of all differences.
All of our positions are open to people with disabilities.
