Cybersecurity Analyst - Vulnerability Management | FORFIRM

FORFIRM CONSULTING SAGL; Ticino; On-site; CHF 110,000 - 140,000; Full time

Job summary

FORFIRM CONSULTING SAGL is seeking a Cybersecurity Analyst specializing in vulnerability management to own the lifecycle from discovery to remediation in Lugano, Switzerland. You will work with Qualys/Nessus and Azure Virtual Desktop to reduce risk and strengthen security posture.

Applicants should have 3+ years of hands-on experience, strong analysis and reporting skills, and competence in communicating risk to both technical and business audiences. English required, Italian a plus.

Qualifications

• Minimum 3 years hands-on experience in vulnerability management or security operations.
• Strong practical knowledge of Qualys (VMDR, Cloud Agent) and Nessus.
• Solid understanding of networking (TCP/IP, firewalls, segmentation) and Windows/Linux systems.
• Familiarity with CVSS, MITRE ATT&CK, OWASP and CIS Benchmarks.
• Experience communicating risk to technical and business audiences.

Responsibilities

• Plan, configure and run vulnerability scans with Qualys or Nessus across networks, servers, endpoints, applications and cloud environments.
• Assess the security posture of Azure Virtual Desktop environments, including session hosts, golden images, host pools and the underlying Azure resources.
• Analyze scan results, eliminate false positives and prioritize vulnerabilities based on severity, exploitability and business context (CVSS).
• Define and track remediation plans in collaboration with IT and infrastructure teams, including image updates and patching cycles for virtual desktop session hosts.
• Verify compliance of AVD session hosts and images with security baselines and hardening standards (e.g. CIS Benchmarks).
• Produce technical and executive reports with KPIs and risk trends for management and clients.
• Maintain scan templates, policies, asset inventories and operating procedures, ensuring dynamic virtual desktop assets are correctly discovered and covered.
• Support audits and compliance assessments (e.g. ISO 27001, NIS2, GDPR/nFADP).
• Monitor emerging threats, CVEs and vendor advisories, and provide best-practice guidance.

Skills

Vulnerability management

Qualys

Nessus

Azure AVD

Networking

Windows

Linux

CVSS

MITRE ATT&CK

OWASP

CIS Benchmarks

English

Tools

Qualys VMDR

Nessus

Azure Virtual Desktop

Job description

Cybersecurity Analyst - Vulnerability Management

• Lugano, Switzerland
• Tempo pieno
• In sede

About FORFIRM

FORFIRM is a multidisciplinary consulting firm specializing in Financial Services, Compliance, Cybersecurity, Digital Transformation and IT Advisory. We support leading organizations in designing, implementing, and optimizing technology solutions that drive business value and operational excellence.

The Role

To strengthen our Cybersecurity practice, we are looking for a Vulnerability Management Specialist with proven hands-on experience with Qualys and Tenable Nessus, and with a solid understanding of Azure Virtual Desktop environments.

The successful candidate will own the full vulnerability management lifecycle within enterprise environments, including virtual desktop infrastructure, from identifying weaknesses to prioritizing remediation and verifying resolution, working closely with technical teams and business stakeholders to reduce risk and strengthen security posture.

Key Responsibilities

• Plan, configure and run vulnerability scans with Qualys or Nessus across networks, servers, endpoints, applications and cloud environments.


• Assess the security posture of Azure Virtual Desktop environments, including session hosts, golden images, host pools and the underlying Azure resources, through agent-based and network scanning.


• Analyze scan results, eliminate false positives and prioritize vulnerabilities based on severity, exploitability and business context (CVSS).


• Define and track remediation plans in collaboration with IT and infrastructure teams, including image updates and patching cycles for virtual desktop session hosts.


• Verify compliance of AVD session hosts and images with security baselines and hardening standards (e.g. CIS Benchmarks).


• Produce technical and executive reports with KPIs and risk trends for management and clients.


• Maintain scan templates, policies, asset inventories and operating procedures, ensuring dynamic virtual desktop assets are correctly discovered and covered.


• Support audits and compliance assessments (e.g. ISO 27001, NIS2, GDPR/nFADP).


• Monitor emerging threats, CVEs and vendor advisories, and provide best-practice guidance.

Requirements

• Minimum 3 years of hands-on experience in vulnerability management or security operations.


• Strong practical knowledge of Qualys (VMDR, Cloud Agent) and Nessus.


• Solid understanding of networking (TCP/IP, firewalls, segmentation) and of Windows and Linux systems.


• Familiarity with CVSS, MITRE ATT&CK, OWASP and CIS Benchmarks.


• Experience working in enterprise environments and communicating risk to both technical and business audiences.


• Excellent analytical, problem-solving and reporting skills.


• Professional proficiency in English; Italian is considered a plus.

Nice to Have

• Security certifications (e.g. CompTIA Security+, CEH, GIAC, CISSP, Qualys or Tenable certifications).


• Knowledge of Azure Virtual Desktop (host pools, session hosts, images, FSLogix) and of the related Microsoft security stack (Microsoft Entra ID, Intune, Microsoft Defender for Cloud).


• Scripting experience (Python, PowerShell, Bash) for automation and API integration.


• Experience with SIEM, patch management and ITSM tools.


• Previous experience in regulated industries, particularly Financial Services.