Vulnerability Management Expert

Pasiona Consulting Sl; Barcelona; On-site; EUR 60,000 - 90,000; Full time

Job summary

Pasiona Consulting busca un profesional de seguridad software para liderar la gestión de vulnerabilidades en entornos modernos. Monitorizarás y priorizarás hallazgos en dependencias, librerías y frameworks, y analizarás resultados de SAST, DAST y SCA.

Implantarás procesos de actualización y remediación en pipelines CI/CD y entornos de contenedores como OpenShift, documentarás evidencias de cumplimiento y colaborarás con Jira para seguimiento, reportando avances a la dirección de seguridad.

Qualifications

• Al menos 3 años de experiencia en seguridad de software y gestión de vulnerabilidades.
• Conocimiento de OWASP Top 10 y métricas CVSS.
• Familiaridad con AWS/Azure/GCP y prácticas de seguridad en contenedores.
• Certificaciones como CISSP, OSCP, CEH o CCSP son valoradas.

Responsibilities

• Monitorear, clasificar y priorizar vulnerabilidades en dependencias.
• Analizar hallazgos de SAST/DAST/SCA.
• Automatizar actualizaciones y remediaciones en CI/CD y OpenShift.
• Documentar evaluaciones y evidencia de cumplimiento con Jira.
• Desarrollar guías de seguridad y mejores prácticas.
• Informar estado de vulnerabilidad y tendencias a la dirección.
• Apoyar respuesta a incidentes de vulnerabilidades críticas.
• Asegurar cumplimiento de ISO 27001, NIST, GDPR y SOC 2.

Job description

• Regularly monitor, triage, and prioritize vulnerabilities in third-party dependencies, libraries, and frameworks.
• Analyze security findings from SAST, DAST, and SCA tools (such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
• Implement and automate processes for dependency updates, vulnerability detection, and remediation within CI/CD pipelines and container environments (like OpenShift).
• Document vulnerability assessments, remediation activities, and compliance evidence using tools like Jira and vulnerability management platforms.
• Develop and enforce secure coding guidelines, dependency management standards, and best practices.
• Report on vulnerability status, remediation progress, and risk trends to stakeholders and security leadership.
• Support incident response related to critical vulnerabilities, including zero-day exploits and high-severity CVEs.
• Ensure adherence to internal policies and external regulations (such as ISO 27001, NIST, GDPR, and SOC 2).
• Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
• Professional certifications such as CISSP, OSCP, CEH, or CCSP.
• Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.
• Experience: Minimum of 3 years of expertise in software security, vulnerability management, or related fields.
• Tools & Technologies:
• Vulnerability detection and management tools (SAST, DAST, SCA such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
• Dependency management across multiple ecosystems (npm, Maven, pip, NuGet, or Go modules).
• Container orchestration and security (OpenShift and Docker).
• Version control systems (Git, GitHub) and issue tracking tools (Jira).
• Skills & Knowledge:
• Proficiency in scripting and automation (Python, Bash) for integrating security processes into CI/CD workflows.
• Deep understanding of vulnerabilities (OWASP Top 10, CWE) and CVSS scoring methodology.
• Experience implementing security best practices within DevOps pipelines and cloud environments.
• Strong analytical and problem-solving skills.
• Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
• Professional certifications such as CISSP, OSCP, CEH, or CCSP.
• Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.

Descripción del puesto / Funciones

• Regularly monitor, triage, and prioritize vulnerabilities in third-party dependencies, libraries, and frameworks.
• Analyze security findings from SAST, DAST, and SCA tools (such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
• Implement and automate processes for dependency updates, vulnerability detection, and remediation within CI/CD pipelines and container environments (like OpenShift).
• Document vulnerability assessments, remediation activities, and compliance evidence using tools like Jira and vulnerability management platforms.
• Develop and enforce secure coding guidelines, dependency management standards, and best practices.
• Report on vulnerability status, remediation progress, and risk trends to stakeholders and security leadership.
• Support incident response related to critical vulnerabilities, including zero-day exploits and high-severity CVEs.
• Ensure adherence to internal policies and external regulations (such as ISO 27001, NIST, GDPR, and SOC 2).

Requisitos mínimos

• Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
• Professional certifications such as CISSP, OSCP, CEH, or CCSP.
• Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.
• Experience: Minimum of 3 years of expertise in software security, vulnerability management, or related fields.
• Tools & Technologies:
  • Vulnerability detection and management tools (SAST, DAST, SCA such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
  • Dependency management across multiple ecosystems (npm, Maven, pip, NuGet, or Go modules).
  • Container orchestration and security (OpenShift and Docker).
  • Version control systems (Git, GitHub) and issue tracking tools (Jira).
• Skills & Knowledge:
  • Proficiency in scripting and automation (Python, Bash) for integrating security processes into CI/CD workflows.
  • Deep understanding of vulnerabilities (OWASP Top 10, CWE) and CVSS scoring methodology.
  • Experience implementing security best practices within DevOps pipelines and cloud environments.
  • Strong analytical and problem-solving skills.

Requisitos valorables

• Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
• Professional certifications such as CISSP, OSCP, CEH, or CCSP.
• Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.

Idiomas

English is a must

Ubicación

Barcelona

¿Quiénes somos?

Pasiona Consulting es una consultora tecnológica, partner de Microsoft, dedicada al diseño, desarrollo e implementación de aplicaciones de software a medida para clientes de múltiples sectores.